[PW_SID:1074833] [v3] Bluetooth: ISO: fix NULL deref in iso_recv() ISO_END handling#3430
[PW_SID:1074833] [v3] Bluetooth: ISO: fix NULL deref in iso_recv() ISO_END handling#3430BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
The ISO_CONT case in iso_recv() properly checks for unexpected continuation frames and oversized fragments before accessing conn->rx_skb. The ISO_END case lacks both checks. When an ISO_END packet arrives without a preceding ISO_START: - conn->rx_skb is NULL (never allocated) - skb_put(conn->rx_skb, ...) dereferences NULL -> kernel crash When an ISO_END fragment length does not exactly match the remaining expected length: - the reassembly is malformed and must be rejected KASAN confirmed the NULL-deref on kernel 7.0.0-rc5 via VHCI: general protection fault, probably for non-canonical address 0xdffffc0000000018 KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] CPU: 0 UID: 0 PID: 72 Comm: kworker/u9:0 Not tainted 7.0.0-rc5 Workqueue: hci0 hci_rx_work RIP: 0010:skb_put+0x27/0x1a0 Call Trace: <TASK> iso_recv+0x5e0/0xee0 hci_rx_work+0x226/0x730 process_one_work+0x633/0x1060 worker_thread+0x45b/0xd10 kthread+0x2c6/0x3b0 ret_from_fork+0x38d/0x5c0 </TASK> Kernel panic - not syncing: Fatal exception Fix by adding validation to the ISO_END case: reject end frames when no rx_skb reassembly buffer exists, and reject end fragments whose length does not exactly complete the expected reassembly. Fixes: ccf74f2 ("Bluetooth: Add ISO Socket") Cc: stable@vger.kernel.org Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
6 times, most recently
from
f465113 to
66f6fb9
Compare
github-actions
bot
force-pushed
the
workflow
branch
3 times, most recently
from
f07ea67 to
9a108c6
Compare
3 participants
The ISO_CONT case in iso_recv() properly checks for unexpected
continuation frames and oversized fragments before accessing
conn->rx_skb. The ISO_END case lacks both checks.
When an ISO_END packet arrives without a preceding ISO_START:
When an ISO_END fragment length does not exactly match the
remaining expected length:
KASAN confirmed the NULL-deref on kernel 7.0.0-rc5 via VHCI:
general protection fault, probably for non-canonical address 0xdffffc0000000018
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
CPU: 0 UID: 0 PID: 72 Comm: kworker/u9:0 Not tainted 7.0.0-rc5
Workqueue: hci0 hci_rx_work
RIP: 0010:skb_put+0x27/0x1a0
Call Trace:
iso_recv+0x5e0/0xee0
hci_rx_work+0x226/0x730
process_one_work+0x633/0x1060
worker_thread+0x45b/0xd10
kthread+0x2c6/0x3b0
ret_from_fork+0x38d/0x5c0
Kernel panic - not syncing: Fatal exception
Fix by adding validation to the ISO_END case: reject end frames
when no rx_skb reassembly buffer exists, and reject end fragments
whose length does not exactly complete the expected reassembly.
Fixes: ccf74f2 ("Bluetooth: Add ISO Socket")
Cc: stable@vger.kernel.org
Signed-off-by: Nathan Rebello nathan.c.rebello@gmail.com
Changes in v3:
handle the case where an ISO_CONT fragment completes rx_len
but a valid zero-length ISO_END still follows.
Changes in v2:
(skb->len != conn->rx_len): the end fragment must exactly
complete the reassembly.
net/bluetooth/iso.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)