linux-kernel - [PATCH] Bluetooth: HCI: fix divide error in __get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun,  5 May 2024 22:20:36 -0400
From: Sungwoo Kim <iam@...g-woo.kim>
To: 
Cc: daveti@...due.edu,
	benquike@...il.com,
	Sungwoo Kim <iam@...g-woo.kim>,
	Marcel Holtmann <marcel@...tmann.org>,
	Johan Hedberg <johan.hedberg@...il.com>,
	Luiz Augusto von Dentz <luiz.dentz@...il.com>,
	linux-bluetooth@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] Bluetooth: HCI: fix divide error in __get_blocks()

hdev->block_len could be 0. Fix this by adding a check.

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci11 hci_tx_work
RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901

Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
Signed-off-by: Sungwoo Kim <iam@...g-woo.kim>
---
 net/bluetooth/hci_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0efd59760..20b1cd7f3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3762,7 +3762,7 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
 
 	__check_timeout(hdev, cnt, type);
 
-	while (hdev->block_cnt > 0 &&
+	while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
 	       (chan = hci_chan_sent(hdev, type, &quote))) {
 		u32 priority = (skb_peek(&chan->data_q))->priority;
 		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
-- 
2.34.1