linux-kernel - Re: [PATCH v3 1/2] Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 1 Feb 2022 17:41:49 -0800
From:   Luiz Augusto von Dentz <luiz.dentz@...il.com>
To:     Radoslaw Biernacki <rad@...ihalf.com>
Cc:     linux-bluetooth <linux-bluetooth@...r.kernel.org>,
        Marcel Holtmann <marcel@...tmann.org>,
        CrosBT Upstreaming <chromeos-bluetooth-upstreaming@...omium.org>,
        Archie Pusaka <apusaka@...omium.org>,
        Miao-chen Chou <mcchou@...omium.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Johan Hedberg <johan.hedberg@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>,
        upstream@...ihalf.com, Angela Czubak <acz@...ihalf.com>,
        Marek Maslanka <mm@...ihalf.com>
Subject: Re: [PATCH v3 1/2] Bluetooth: Fix skb allocation in
 mgmt_remote_name() & mgmt_device_connected()

Hi Radoslaw,

On Tue, Feb 1, 2022 at 12:10 PM Radoslaw Biernacki <rad@...ihalf.com> wrote:
>
> This patch fixes skb allocation, as lack of space for ev might push skb
> tail beyond its end.
> Also introduce eir_precalc_len() that can be used instead of magic
> numbers for similar eir operations on skb.
>
> Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND")
> Fixes: e96741437ef0a ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_CONNECTED")
> Signed-off-by: Angela Czubak <acz@...ihalf.com>
> Signed-off-by: Marek Maslanka <mm@...ihalf.com>
> Signed-off-by: Radoslaw Biernacki <rad@...ihalf.com>
> ---
>  net/bluetooth/eir.h  |  5 +++++
>  net/bluetooth/mgmt.c | 18 ++++++++----------
>  2 files changed, 13 insertions(+), 10 deletions(-)
>
> diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h
> index 05e2e917fc25..e5876751f07e 100644
> --- a/net/bluetooth/eir.h
> +++ b/net/bluetooth/eir.h
> @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr);
>  u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len);
>  u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len);
>
> +static inline u16 eir_precalc_len(u8 data_len)
> +{
> +       return sizeof(u8) * 2 + data_len;
> +}
> +
>  static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,
>                                   u8 *data, u8 data_len)
>  {
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 5dd684e0b259..43ca228104ce 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -9061,12 +9061,14 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
>         u16 eir_len = 0;
>         u32 flags = 0;
>
> +       /* allocate buff for LE or BR/EDR adv */
>         if (conn->le_adv_data_len > 0)
>                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
> -                                    conn->le_adv_data_len);
> +                                    sizeof(*ev) + conn->le_adv_data_len);
>         else
>                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
> -                                    2 + name_len + 5);
> +                                    sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
> +                                    eir_precalc_len(sizeof(conn->dev_class)));
>
>         ev = skb_put(skb, sizeof(*ev));
>         bacpy(&ev->addr.bdaddr, &conn->dst);
> @@ -9785,13 +9787,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
>  {
>         struct sk_buff *skb;
>         struct mgmt_ev_device_found *ev;
> -       u16 eir_len;
> -       u32 flags;
> +       u16 eir_len = 0;
> +       u32 flags = 0;
>
> -       if (name_len)
> -               skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len);
> -       else
> -               skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0);
> +       skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
> +                            sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
>
>         ev = skb_put(skb, sizeof(*ev));
>         bacpy(&ev->addr.bdaddr, bdaddr);
> @@ -9801,10 +9801,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
>         if (name) {
>                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
>                                           name_len);
> -               flags = 0;
>                 skb_put(skb, eir_len);
>         } else {
> -               eir_len = 0;
>                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
>         }
>
> --
> 2.35.0.rc2.247.g8bbb082509-goog
>

Applied, thanks.


-- 
Luiz Augusto von Dentz