[PW_SID:1079845] [v2] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt#63
[PW_SID:1079845] [v2] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt#63BluezTestBot wants to merge 1 commit intoworkflowfrom
Conversation
…_big_complete_evt
hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration. However, there is no check that i stays within ev->num_bis
before the array access.
When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory. Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state. The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.
Fix this by:
- Breaking out of the loop when i reaches ev->num_bis and cleaning
up all remaining BT_BOUND connections, then terminating the BIG
since a mismatch between the host and controller state indicates
failure.
- Properly cleaning up the connection when hci_conn_set_handle()
fails, instead of calling continue which leaves it in BT_BOUND
state where it would be found again by the same lookup on the
next iteration.
Fixes: a0bfde1 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: ZhiTao Ou <hkbinbinbin@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
TestRunner_6lowpan-tester |
|
IncrementalBuild |
2 participants
From: ZhiTao Ou hkbinbinbin@gmail.com
hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration. However, there is no check that i stays within ev->num_bis
before the array access.
When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory. Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state. The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.
Fix this by:
Breaking out of the loop when i reaches ev->num_bis and cleaning
up all remaining BT_BOUND connections, then terminating the BIG
since a mismatch between the host and controller state indicates
failure.
Properly cleaning up the connection when hci_conn_set_handle()
fails, instead of calling continue which leaves it in BT_BOUND
state where it would be found again by the same lookup on the
next iteration.
Fixes: a0bfde1 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: ZhiTao Ou hkbinbinbin@gmail.com
net/bluetooth/hci_event.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)