To: <20251020151255.1807712-1-Ilia.Gavrilov@infotecs.ru> From: Luiz Augusto von Dentz Date: Thu, 23 Oct 2025 09:18:13 -0400 X-Gm-Features: AS18NWAOr4vPXVJkPYtTy29M3zZKn1wN4ylPEGtp4Ibczfl2RaoyytNjp5Xysuc Message-ID: Subject: Re: [PATCH net] Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() To: Ilia Gavrilov Cc: Marcel Holtmann , Johan Hedberg , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , "linux-bluetooth@vger.kernel.org" , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "lvc-project@linuxtesting.org" , "stable@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-DKIM: signer='gmail.com' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [142.0.200.124 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [luiz.dentz[at]gmail.com] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager SpamTally: Final spam score: 4 Hi Ilia, On Mon, Oct 20, 2025 at 11:12=E2=80=AFAM Ilia Gavrilov wrote: > > In the parse_adv_monitor_pattern() function, the value of > the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). > The size of the 'value' array in the mgmt_adv_pattern structure is 31. > If the value of 'pattern[i].length' is set in the user space > and exceeds 31, the 'patterns[i].value' array can be accessed > out of bound when copied. > > Increasing the size of the 'value' array in > the 'mgmt_adv_pattern' structure will break the userspace. > Considering this, and to avoid OOB access revert the limits for 'offset' > and 'length' back to the value of HCI_MAX_AD_LENGTH. > > Found by InfoTeCS on behalf of Linux Verification Center > (linuxtesting.org) with SVACE. > > Fixes: db08722fc7d4 ("Bluetooth: hci_core: Fix missing instances using HC= I_MAX_AD_LENGTH") > Cc: stable@vger.kernel.org > Signed-off-by: Ilia Gavrilov > --- > include/net/bluetooth/mgmt.h | 2 +- > net/bluetooth/mgmt.c | 6 +++--- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h > index 74edea06985b..4b07ce6dfd69 100644 > --- a/include/net/bluetooth/mgmt.h > +++ b/include/net/bluetooth/mgmt.h > @@ -780,7 +780,7 @@ struct mgmt_adv_pattern { > __u8 ad_type; > __u8 offset; > __u8 length; > - __u8 value[31]; > + __u8 value[HCI_MAX_AD_LENGTH]; Why not use HCI_MAX_EXT_AD_LENGTH above? Or perhaps even make it opaque since the actual size is defined by length - offset. > } __packed; > > #define MGMT_OP_ADD_ADV_PATTERNS_MONITOR 0x0052 > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > index a3d16eece0d2..500033b70a96 100644 > --- a/net/bluetooth/mgmt.c > +++ b/net/bluetooth/mgmt.c > @@ -5391,9 +5391,9 @@ static u8 parse_adv_monitor_pattern(struct adv_moni= tor *m, u8 pattern_count, > for (i =3D 0; i < pattern_count; i++) { > offset =3D patterns[i].offset; > length =3D patterns[i].length; > - if (offset >=3D HCI_MAX_EXT_AD_LENGTH || > - length > HCI_MAX_EXT_AD_LENGTH || > - (offset + length) > HCI_MAX_EXT_AD_LENGTH) > + if (offset >=3D HCI_MAX_AD_LENGTH || > + length > HCI_MAX_AD_LENGTH || > + (offset + length) > HCI_MAX_AD_LENGTH) > return MGMT_STATUS_INVALID_PARAMS; > > p =3D kmalloc(sizeof(*p), GFP_KERNEL); > -- > 2.39.5 --=20 Luiz Augusto von Dentz From - Thu Oct 23 13:23:55 2025 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id eFz3Lmcs+mgGDyYAYBR5ng (envelope-from ) for ; Thu, 23 Oct 2025 13:23:51 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 23 Oct 2025 13:23:51 +0000 Received: from dfw.mirrors.kernel.org ([142.0.200.124]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vBvIF-0000000BkaF-0ETV for hi@josie.lol; Thu, 23 Oct 2025 13:23:51 +0000 Received: from smtp.subspace.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.mirrors.kernel.org (Postfix) with ESMTPS id 262C14E2525 for ; Thu, 23 Oct 2025 13:23:50 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D7C3030C345; Thu, 23 Oct 2025 13:23:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="B01qGBel" X-Original-To: io-uring@vger.kernel.org Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3FA043019DA; Thu, 23 Oct 2025 13:23:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761225826; cv=none; b=EFdmen/4CSrXmKhPOjjCG5Y1bRP8W2Ylc/ob+USRc0Cx64+iPWc1BHryQ8oamZ5WTwA9Yz/i6jySKc8DDkNWtuWBb8YqwIxQmCZAMzDvGcNgG2mnoVlWSsbz/G3n2uk3I0wG64Z8NOfFzyJLWRuLU2tyjCiHEckJUYwWlTscD94= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761225826; c=relaxed/simple; bh=UZJ7rtuDhf2dV+t2MpDDxignV1q/vjHFdxInnFmgxbg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=buzh0Lx7gn+FMz/HFzk7vPdmP1cpEi8mCd41a+Ub0X9pRWYxakfgnjKsSIlpV6yezyuAM1uNghPH7XbIuzuddW4DYWTh/40PekewCjfPJbUqRbHmXbiDrJRnpyUMWOE5D1Jo