]> git.baikalelectronics.ru Git - kernel.git/commit
Bluetooth: stop proccessing malicious adv data
authorPavel Skripkin <paskripkin@gmail.com>
Mon, 1 Nov 2021 07:12:12 +0000 (10:12 +0300)
committerMarcel Holtmann <marcel@holtmann.org>
Tue, 16 Nov 2021 12:59:20 +0000 (13:59 +0100)
commit2d2070650c36e53f505e2a5f68a393fe9041d22e
treec3e6b7d83ea115d0fad007d36fdf3691aec1e071
parent25591ed53defd7d5b0cf12dcd1e2437b78f1e35e
Bluetooth: stop proccessing malicious adv data

Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The
problem was in missing validaion check.

We should check if data is not malicious and we can read next data block.
If we won't check ptr validness, code can read a way beyond skb->end and
it can cause problems, of course.

Fixes: da8dbcef0432 ("Bluetooth: hci_le_adv_report_evt code refactoring")
Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/hci_event.c