korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2025-01-07 22:34:18 +08:00
Code Issues Packages Projects Releases Wiki Activity
2de0e6a71c
linux/net/bluetooth
History
Pavel Skripkin 2de0e6a71c Bluetooth: stop proccessing malicious adv data 
[ Upstream commit 3a56ef719f ]

Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The
problem was in missing validaion check.

We should check if data is not malicious and we can read next data block.
If we won't check ptr validness, code can read a way beyond skb->end and
it can cause problems, of course.

Fixes: e95beb4141 ("Bluetooth: hci_le_adv_report_evt code refactoring")
Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 11:03:11 +01:00
..
bnep Bluetooth: bnep: Use the correct print format 2021-06-26 07:12:40 +02:00
cmtp Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails 2022-01-27 11:03:03 +01:00
hidp Bluetooth: hidp: Use the correct print format 2021-06-26 07:12:40 +02:00
rfcomm TTY / Serial patches for 5.15-rc1 2021-09-01 09:51:16 -07:00
6lowpan.c Bluetooth: 6lowpan: Use the correct print format 2021-06-26 07:12:41 +02:00
a2mp.c Bluetooth: a2mp: Use the correct print format 2021-06-26 07:12:41 +02:00
a2mp.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
af_bluetooth.c Bluetooth: fix indentation and alignment reported by checkpatch 2021-01-29 16:51:45 +01:00
amp.c Bluetooth: amp: Use the correct print format 2021-06-26 07:12:41 +02:00
amp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
aosp.c Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
aosp.h Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
ecdh_helper.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
ecdh_helper.h Fix misc new gcc warnings 2021-04-27 17:05:53 -07:00
hci_conn.c Bluetooth: use inclusive language in HCI role comments 2021-06-26 07:12:43 +02:00
hci_core.c Bluetooth: add quirk disabling LE Read Transmit Power 2022-01-16 09:12:44 +01:00
hci_debugfs.c Bluetooth: use inclusive language when filtering devices 2021-06-26 07:12:44 +02:00
hci_debugfs.h
hci_event.c Bluetooth: stop proccessing malicious adv data 2022-01-27 11:03:11 +01:00
hci_request.c Bluetooth: Fix not generating RPA when required 2021-08-03 23:30:50 +02:00
hci_request.h Bluetooth: Resume advertising after LE connection 2020-11-09 13:33:19 +01:00
hci_sock.c Bluetooth: defer cleanup of resources in hci_unregister_dev() 2021-08-05 12:15:24 -07:00
hci_sysfs.c bluetooth-next pull request for net-next: 2021-08-20 12:16:05 +01:00
Kconfig Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
l2cap_core.c Bluetooth: use inclusive language when filtering devices 2021-06-26 07:12:44 +02:00
l2cap_sock.c Bluetooth: L2CAP: Fix not initializing sk_peer_pid 2022-01-27 11:03:01 +01:00
leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Introduce debug feature when dynamic debug is disabled 2020-05-11 12:16:27 +02:00
Makefile Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
mgmt_config.c Bluetooth: mgmt: Use the correct print format 2021-06-26 07:12:42 +02:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c networking: make skb_push & __skb_push return void pointers 2017-06-16 11:48:40 -04:00
mgmt_util.h
mgmt.c Bluetooth: mgmt: Pessimize compile-time bounds-check 2021-08-19 16:51:53 +02:00
msft.c Bluetooth: msft: Use the correct print format 2021-06-26 07:12:42 +02:00
msft.h Bluetooth: Allow Microsoft extension to indicate curve validation 2021-04-08 12:26:34 +02:00
sco.c Bluetooth: fix init and cleanup of sco_conn.timeout_work 2021-11-18 19:16:22 +01:00
selftest.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
selftest.h
smp.c Bluetooth: use inclusive language in HCI role comments 2021-06-26 07:12:43 +02:00
smp.h Bluetooth: use inclusive language in SMP 2021-06-26 07:12:37 +02:00