lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 13 Jan 2022 08:17:01 -0800 From: Luiz Augusto von Dentz <luiz.dentz@...il.com> To: Radoslaw Biernacki <rad@...ihalf.com> Cc: linux-bluetooth <linux-bluetooth@...r.kernel.org>, Marcel Holtmann <marcel@...tmann.org>, CrosBT Upstreaming <chromeos-bluetooth-upstreaming@...omium.org>, Archie Pusaka <apusaka@...omium.org>, Miao-chen Chou <mcchou@...omium.org>, Jakub Kicinski <kuba@...nel.org>, Johan Hedberg <johan.hedberg@...il.com>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>, upstream@...ihalf.com, Angela Czubak <acz@...ihalf.com>, Marek Maslanka <mm@...ihalf.com> Subject: Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() Hi Radoslaw, On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@...ihalf.com> wrote: > > From: Radoslaw Biernacki <rad@...ihalf.com> > > This patch fixes skb allocation, as lack of space for ev might push skb > tail beyond its end. > Also introduce eir_precalc_len() that can be used instead of magic > numbers for similar eir operations on skb. > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > Signed-off-by: Angela Czubak <acz@...ihalf.com> > Signed-off-by: Marek Maslanka <mm@...ihalf.com> > Signed-off-by: Radoslaw Biernacki <rad@...ihalf.com> > --- > net/bluetooth/eir.h | 5 +++++ > net/bluetooth/mgmt.c | 12 ++++-------- > 2 files changed, 9 insertions(+), 8 deletions(-) > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > index 05e2e917fc25..e5876751f07e 100644 > --- a/net/bluetooth/eir.h > +++ b/net/bluetooth/eir.h > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > +static inline u16 eir_precalc_len(u8 data_len) > +{ > + return sizeof(u8) * 2 + data_len; > +} > + > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > u8 *data, u8 data_len) > { > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > index 37087cf7dc5a..d517fd847730 100644 > --- a/net/bluetooth/mgmt.c > +++ b/net/bluetooth/mgmt.c > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > { > struct sk_buff *skb; > struct mgmt_ev_device_found *ev; > - u16 eir_len; > - u32 flags; > + u16 eir_len = 0; > + u32 flags = 0; > > - if (name_len) > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > - else > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); Looks like mgmt_device_connected also has a similar problem. > ev = skb_put(skb, sizeof(*ev)); > bacpy(&ev->addr.bdaddr, bdaddr); > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > if (name) { > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > name_len); > - flags = 0; > skb_put(skb, eir_len); > } else { > - eir_len = 0; > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > } These changes would leave flags and eir_len uninitialized. > -- > 2.34.1.703.g22d0c6ccf7-goog > -- Luiz Augusto von Dentz
Powered by blists - more mailing lists