[PW_SID:1077246] Bluetooth: BNEP: validate control header bytes before reading them#3447
[PW_SID:1077246] Bluetooth: BNEP: validate control header bytes before reading them#3447BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
`bnep_rx_frame()` pulls the first byte from the skb and immediately reads the control type from the remaining data. Short control packets can leave no bytes in the skb at that point. The later control-message pull logic also reads `skb->data + 1` before proving that the length byte or 16-bit filter length is actually present. Validate the required control-header bytes before each dereference and drop malformed frames through the existing bad-frame path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
4 times, most recently
from
f07ea67 to
9a108c6
Compare
3 participants
bnep_rx_frame()pulls the first byte from the skb and immediately readsthe control type from the remaining data. Short control packets can leave
no bytes in the skb at that point.
The later control-message pull logic also reads
skb->data + 1beforeproving that the length byte or 16-bit filter length is actually present.
Validate the required control-header bytes before each dereference and
drop malformed frames through the existing bad-frame path.
Signed-off-by: Pengpeng Hou pengpeng@iscas.ac.cn
net/bluetooth/bnep/core.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)