Commit 7d4238ed authored Nov 01, 2021 by Pavel Skripkin Committed by Greg Kroah-Hartman Jan 27, 2022

Bluetooth: stop proccessing malicious adv data



[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ]

Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The
problem was in missing validaion check.

We should check if data is not malicious and we can read next data block.
If we won't check ptr validness, code can read a way beyond skb->end and
it can cause problems, of course.

Fixes: e95beb41 ("Bluetooth: hci_le_adv_report_evt code refactoring")
Reported-and-tested-by:  <syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 9a5d57df

net/bluetooth/hci_event.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -4967,7 +4967,8 @@ static void hci_le_adv_report_evt(struct hci_dev hdev, struct sk_buff skb)
		struct hci_ev_le_advertising_info *ev = ptr;
		s8 rssi;

		if (ev->length <= HCI_MAX_AD_LENGTH) {
		if (ev->length <= HCI_MAX_AD_LENGTH &&
		ev->data + ev->length <= skb_tail_pointer(skb)) {
		rssi = ev->data[ev->length];
		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
		ev->bdaddr_type, NULL, 0, rssi,
		@@ -4977,6 +4978,11 @@ static void hci_le_adv_report_evt(struct hci_dev hdev, struct sk_buff skb)
		}

		ptr += sizeof(*ev) + ev->length + 1;

		if (ptr > (void ) skb_tail_pointer(skb) - sizeof(ev)) {
		bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
		break;
		}
		}

		hci_dev_unlock(hdev);