From 5f625827a54b9f3478fa8e0484f5d544f8359f46 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 23 Dec 2020 19:16:54 +0100 Subject: [PATCH] 4.9-stable patches added patches: bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch --- ...read-in-hci_le_direct_adv_report_evt.patch | 53 +++++++++++++++++++ queue-4.9/series | 1 + 2 files changed, 54 insertions(+) create mode 100644 queue-4.9/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch diff --git a/queue-4.9/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch b/queue-4.9/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch new file mode 100644 index 00000000000..4b4f64d31ef --- /dev/null +++ b/queue-4.9/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch @@ -0,0 +1,53 @@ +From f7e0e8b2f1b0a09b527885babda3e912ba820798 Mon Sep 17 00:00:00 2001 +From: Peilin Ye +Date: Wed, 9 Sep 2020 03:17:00 -0400 +Subject: Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() + +From: Peilin Ye + +commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream. + +`num_reports` is not being properly checked. A malformed event packet with +a large `num_reports` number makes hci_le_direct_adv_report_evt() read out +of bounds. Fix it. + +Cc: stable@vger.kernel.org +Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events") +Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01 +Signed-off-by: Peilin Ye +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_event.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5141,20 +5141,18 @@ static void hci_le_direct_adv_report_evt + struct sk_buff *skb) + { + u8 num_reports = skb->data[0]; +- void *ptr = &skb->data[1]; ++ struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1]; + +- hci_dev_lock(hdev); ++ if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1) ++ return; + +- while (num_reports--) { +- struct hci_ev_le_direct_adv_info *ev = ptr; ++ hci_dev_lock(hdev); + ++ for (; num_reports; num_reports--, ev++) + process_adv_report(hdev, ev->evt_type, &ev->bdaddr, + ev->bdaddr_type, &ev->direct_addr, + ev->direct_addr_type, ev->rssi, NULL, 0); + +- ptr += sizeof(*ev); +- } +- + hci_dev_unlock(hdev); + } + diff --git a/queue-4.9/series b/queue-4.9/series index 9ad1c1a4c8c..6df9c9e15bd 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -46,3 +46,4 @@ hid-i2c-hid-add-vero-k147-to-descriptor-override.patch serial_core-check-for-port-state-when-tty-is-in-error-state.patch media-msi2500-assign-spi-bus-number-dynamically.patch md-fix-a-warning-caused-by-a-race-between-concurrent-md_ioctl-s.patch +bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch -- 2.47.3