From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vs2-f12.google.com (mail-vs2-f12.google.com [74.125.227.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8339E3D3CFD for ; Tue, 15 Sep 2026 16:03:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.12 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789488204; cv=none; b=hzQEgv0xc8d/vH5zjMgnHRq442ybOeXj4Zg3xYggQWLwMaF7RRvBawTUaTngQSSaCB/AjWXkNeqMSs+OwxKjYV1H/D4mWAMZzsK8p0b9h6yKTd24wIGUQsTTO3cvM9fMv4xWJsrgU7OBsTnO7QrgSy4Rq2Gt50RkOeIBHcOKkkQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789488204; c=relaxed/simple; bh=MDx1/NX+bEC+aezbHbNquhfyK8DKjxbfewpr5X2JZIc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ev1mAq8UNC4D8Q5zE2tUqljBMAj43Gl6Qg9aHA/r/wsVAAHqympK7GZ0vhIqTojANDlYIjkI/J4bH0HluuIM1UvTjyHWQ/MHZ1MCJ2Te6exYDYMIeNFZcebXZVMz9aD9nDjrwCEYoblWjZYPr6hVda3VzQm03omgz+07hy5E2z4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZjuDeQ1B; arc=none smtp.client-ip=74.125.227.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZjuDeQ1B" Received: by mail-vs2-f12.google.com with SMTP id ada2fe7eead31-79022baa364so792610137.1 for ; Tue, 15 Sep 2026 09:03:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789488200; x=1790093000; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=npO8t2qXgFPBX9kJDOsnq7lsoV93cjjCTUdlKsebcTA=; b=ZjuDeQ1B9YE9OjsIb+z8P3aEKa7MsWAxJ5gAaX+3hfqap3bxgPA8Nt+jCDbuGTchdg 7E1fUtE7mSYTvqe9HF+rceqTa6YXet0d47upBvIxO6FRfyDbd4tlfsHaHGUygzPANnZG bQ4Wqv+DV0bEu/EYkVcsWj8M4w1f0YANGPGm3HWBiM0c+aTfwVIittocKp9SFsy1cFS9 4s0hp1f3lgjW8SnaBPygw9iJulc7dH4RJ3BiXzQbMy8Mu9KBDNnlB5aloCMnZxabtPfw kXzlN8KdvMeyZWFIiBSDJ0LD9nO2kRcoKw2aHONWhUdnCVcjtwcynAITt+QFvAOdEIce ijOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789488200; x=1790093000; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=npO8t2qXgFPBX9kJDOsnq7lsoV93cjjCTUdlKsebcTA=; b=JTLGbE/iNQQM74G8ZwIJ6Bgegwl+wCVBZbOC6GWxjyxLfUd68Jbxl+D9JPJDs/rbSt olAbTLrkV9KOcDWVTWCYGH7KFP8bpD5oaAlG6kwTSrdrdW+hGt0AE9w/N3rbD4tLs/oI Q2GMliAyd8znOfnXRIUM1xtiWSiluUQ0eQ2pnLFnGjAeoFz00b6IwYXiIW5GfLQ9Vvee a7bykSAWSdY/VfDjoAVD2o2zd1V2Hf0qFeBwc0xLFsDzcW2cbx8PZCaxopnJ15K1CW37 Zm/XLEu/7KIiHcwWi3NhnCMaCpqBByyOfvURfnFcFMRAB+7RluMwfdzwQPY+jM4DoYEP LIrQ== X-Forwarded-Encrypted: i=1; AKwUvBz/aC9OUsuaNDkGqMzimHyX7Rzui0gz2V/H/t9etEtAM+v16Wj3itWCLLHji+JUIDWVgILD1ZOMAZ9ICFo=@vger.kernel.org X-Gm-Message-State: AFuF++nwle9ox5LO1OJJu1tmG5UoSzp11KsHfgSfxP/uZFVpZR5ialX+ EUSqSH+4Hr0jrLjEh1PHqowAohb6uZ+DpsOMoUFGFQvzR91bDr5p+hoTR7/4vTsGBc8= X-Gm-Gg: AYBFou1gvRKHieb4zZrZlG2yE9e6ZIVl4AmuS6GIllI9Aa4GfDf0Swe/V9/KQAy4xd+ 54TlOEhW3VziSQHybN2dhJ76cAMx7MpvmSJvgH9c8KW5XqQuRn3FLoKDCIoBC9cv69kMoslPJb5 mxNU0blRKHHFO8bdoJ/hOzvo7t1lIyGKHPpVheebfrx6hEKKBk25wA3A0v7DMq9j5/oUpOmHHSC EMpo+JRTed8Ya4YH/pRIHvVwyBMc/0vqjpTknL91BAQRMn4mRrvDjX+Tl6A093DdpuMX6X7SI4a NkgtJ+XPvrFHDpI+7KN3C59OTZGtRYmiLsRgMozNWwwKIAQ/jb++c8lY6FFpybh5ayjtV1yhqfk s4ZXveOm7qbIOeFJk87kxxgIyNw+R8hxKGLjcSv1Ad7SdqM11bbdtC0RrpX4RWCk3PvjYM9pYQm TA+MDef2nB257VBClQ8pLBV9deEt02+KVDp8gZqXOCBpVhRV1i5FxM+XVf7nK0+O5f X-Received: by 2002:a05:6102:e0d:b0:786:a11e:484d with SMTP id ada2fe7eead31-79d253fbca6mr2368663137.6.1789488200228; Tue, 15 Sep 2026 09:03:20 -0700 (PDT) Received: from beelink.. ([187.13.206.89]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-79fb2fd68f7sm76158137.12.2026.09.15.09.03.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Sep 2026 09:03:20 -0700 (PDT) From: Aldo Ariel Panzardo To: Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Aldo Ariel Panzardo Subject: [PATCH] Bluetooth: hci_sock: validate event length before filtering Date: Tue, 15 Sep 2026 13:03:07 -0300 Message-ID: <20260915160307.3106955-1-qwe.aldo@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcode at offsets 3 or 4 without checking that a Command Complete or Command Status event is long enough. hci_send_to_sock() invokes the filter before hci_event_packet() validates the event header. A malformed event supplied by a controller or a vhci device can therefore cause an out-of-bounds read. Keep the unmasked event code for the opcode checks. The masked value is needed for the 64-bit event bitmap, but using it to identify command events aliases event codes above 0x3f. In particular, Synchronous Train Complete (0x4f) was treated as Command Status (0x0f) even though its payload has no opcode. Reject actual command events that are too short for the field being inspected. A truncated command event cannot match a configured opcode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo --- net/bluetooth/hci_sock.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index 070ca388f..f6406dcec 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -164,6 +164,7 @@ static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) { struct hci_filter *flt; int flt_type, flt_event; + u8 event; /* Apply filter */ flt = &hci_pi(sk)->filter; @@ -177,7 +178,11 @@ static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) return false; - flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS); + if (skb->len < 1) + return true; + + event = *(__u8 *)skb->data; + flt_event = event & HCI_FLT_EVENT_BITS; if (!hci_test_bit(flt_event, &flt->event_mask)) return true; @@ -186,11 +191,17 @@ static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) if (!flt->opcode) return false; - if (flt_event == HCI_EV_CMD_COMPLETE && + if (event == HCI_EV_CMD_COMPLETE && skb->len < 5) + return true; + + if (event == HCI_EV_CMD_COMPLETE && flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) return true; - if (flt_event == HCI_EV_CMD_STATUS && + if (event == HCI_EV_CMD_STATUS && skb->len < 6) + return true; + + if (event == HCI_EV_CMD_STATUS && flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) return true; -- 2.43.0