[PW_SID:1100657] [v1,1/1] Bluetooth: L2CAP: fix heap over-read in l2cap_get_conf_opt#240
[PW_SID:1100657] [v1,1/1] Bluetooth: L2CAP: fix heap over-read in l2cap_get_conf_opt#240BluezTestBot wants to merge 1 commit into
Conversation
l2cap_get_conf_opt() reads opt->val via a switch on opt->len (1, 2, or 4 bytes). opt->len is a remote-controlled u8. All three callers loop on (len >= L2CAP_CONF_OPT_SIZE), so the loop body executes with as few as 2 bytes remaining. A packet ending with opt->len=4 and only 2 bytes left causes get_unaligned_le32(opt->val) to read 4 bytes past the buffer before the caller can act on the return value. Commit 7c9cbd0 ("Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer") added a post-call len < 0 guard in each caller, but the over-read fires inside l2cap_get_conf_opt() before that guard is reached. Add a buflen parameter and validate L2CAP_CONF_OPT_SIZE + opt->len <= buflen before any access to opt->val. Return -EINVAL on violation. Update all three callers to capture the return value and break on negative. With the bounds check ensuring the option fits within the remaining buffer, the post-call len < 0 check is no longer needed and is removed. Fixes: 7c9cbd0 ("Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
IncrementalBuild |
1 participant
l2cap_get_conf_opt() reads opt->val via a switch on opt->len (1, 2,
or 4 bytes). opt->len is a remote-controlled u8. All three callers
loop on (len >= L2CAP_CONF_OPT_SIZE), so the loop body executes with
as few as 2 bytes remaining. A packet ending with opt->len=4 and
only 2 bytes left causes get_unaligned_le32(opt->val) to read 4 bytes
past the buffer before the caller can act on the return value.
Commit 7c9cbd0 ("Bluetooth: Verify that l2cap_get_conf_opt
provides large enough buffer") added a post-call len < 0 guard in
each caller, but the over-read fires inside l2cap_get_conf_opt()
before that guard is reached.
Add a buflen parameter and validate L2CAP_CONF_OPT_SIZE + opt->len
<= buflen before any access to opt->val. Return -EINVAL on
violation. Update all three callers to capture the return value and
break on negative. With the bounds check ensuring the option fits
within the remaining buffer, the post-call len < 0 check is no
longer needed and is removed.
Fixes: 7c9cbd0 ("Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal meatuni001@gmail.com
net/bluetooth/l2cap_core.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)