Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b78763e0 authored by Peilin Ye's avatar Peilin Ye Committed by Greg Kroah-Hartman
Browse files

Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() 



commit 629b49c848ee71244203934347bd7730b0ddee8d upstream.

Check `num_rsp` before using it as for-loop counter. Add `unlock` label.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarPeilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 70d1e884

net/bluetooth/hci_event.c

+7 −0
Original line number Diff line number Diff line
@@ -4067,6 +4067,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
		struct inquiry_info_with_rssi_and_pscan_mode *info;

		info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;



		for (; num_rsp; num_rsp--, info++) {

			u32 flags;
@@ -4088,6 +4091,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
	} else {

		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;



		for (; num_rsp; num_rsp--, info++) {

			u32 flags;
@@ -4108,6 +4114,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
		}

	}



unlock:

	hci_dev_unlock(hdev);

}