From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Linus Torvalds" <torvalds@linux-foundation.org>,
"Ben Seri" <ben@armis.com>,
"Marcel Holtmann" <marcel@holtmann.org>
Subject: [PATCH 3.2 65/74] Bluetooth: Properly check L2CAP config option output buffer length
Date: Mon, 09 Oct 2017 13:30:34 +0100 [thread overview]
Message-ID: <lsq.1507552234.811919105@decadent.org.uk> (raw)
In-Reply-To: <lsq.1507552233.547064726@decadent.org.uk>
3.2.94-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Seri <ben@armis.com>
commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream.
Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Drop changes to handling of L2CAP_CONF_EFS, L2CAP_CONF_EWS
- Drop changes to l2cap_do_create(), l2cap_security_cfm(), and L2CAP_CONF_PENDING
case in l2cap_config_rsp()
- In l2cap_config_rsp(), s/buf/req/
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -68,7 +68,7 @@ static struct sk_buff *l2cap_build_cmd(s
u8 code, u8 ident, u16 dlen, void *data);
static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
void *data);
-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
static void l2cap_send_disconn_req(struct l2cap_conn *conn,
struct l2cap_chan *chan, int err);
@@ -787,7 +787,7 @@ static void l2cap_conn_start(struct l2ca
set_bit(CONF_REQ_SENT, &chan->conf_state);
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, buf), buf);
+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
chan->num_conf_req++;
}
@@ -1825,12 +1825,15 @@ static inline int l2cap_get_conf_opt(voi
return len;
}
-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
{
struct l2cap_conf_opt *opt = *ptr;
BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
+ if (size < L2CAP_CONF_OPT_SIZE + len)
+ return;
+
opt->type = type;
opt->len = len;
@@ -1901,11 +1904,12 @@ static inline __u8 l2cap_select_mode(__u
}
}
-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
{
struct l2cap_conf_req *req = data;
struct l2cap_conf_rfc rfc = { .mode = chan->mode };
void *ptr = req->data;
+ void *endptr = data + data_size;
BT_DBG("chan %p", chan);
@@ -1926,7 +1930,7 @@ static int l2cap_build_conf_req(struct l
done:
if (chan->imtu != L2CAP_DEFAULT_MTU)
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
switch (chan->mode) {
case L2CAP_MODE_BASIC:
@@ -1942,7 +1946,7 @@ done:
rfc.max_pdu_size = 0;
l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
- (unsigned long) &rfc);
+ (unsigned long) &rfc, endptr - ptr);
break;
case L2CAP_MODE_ERTM:
@@ -1956,7 +1960,7 @@ done:
rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
- (unsigned long) &rfc);
+ (unsigned long) &rfc, endptr - ptr);
if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
break;
@@ -1964,7 +1968,8 @@ done:
if (chan->fcs == L2CAP_FCS_NONE ||
test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
chan->fcs = L2CAP_FCS_NONE;
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs,
+ endptr - ptr);
}
break;
@@ -1979,7 +1984,7 @@ done:
rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
- (unsigned long) &rfc);
+ (unsigned long) &rfc, endptr - ptr);
if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
break;
@@ -1987,7 +1992,8 @@ done:
if (chan->fcs == L2CAP_FCS_NONE ||
test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
chan->fcs = L2CAP_FCS_NONE;
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs,
+ endptr - ptr);
}
break;
}
@@ -1998,10 +2004,11 @@ done:
return ptr - data;
}
-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
{
struct l2cap_conf_rsp *rsp = data;
void *ptr = rsp->data;
+ void *endptr = data + data_size;
void *req = chan->conf_req;
int len = chan->conf_len;
int type, hint, olen;
@@ -2077,8 +2084,8 @@ done:
if (chan->num_conf_rsp == 1)
return -ECONNREFUSED;
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
- sizeof(rfc), (unsigned long) &rfc);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+ (unsigned long) &rfc, endptr - ptr);
}
@@ -2092,7 +2099,7 @@ done:
chan->omtu = mtu;
set_bit(CONF_MTU_DONE, &chan->conf_state);
}
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
switch (rfc.mode) {
case L2CAP_MODE_BASIC:
@@ -2117,7 +2124,7 @@ done:
set_bit(CONF_MODE_DONE, &chan->conf_state);
l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
- sizeof(rfc), (unsigned long) &rfc);
+ sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
break;
@@ -2129,8 +2136,8 @@ done:
set_bit(CONF_MODE_DONE, &chan->conf_state);
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
- sizeof(rfc), (unsigned long) &rfc);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+ (unsigned long) &rfc, endptr - ptr);
break;
@@ -2151,10 +2158,12 @@ done:
return ptr - data;
}
-static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
+static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+ void *data, size_t size, u16 *result)
{
struct l2cap_conf_req *req = data;
void *ptr = req->data;
+ void *endptr = data + size;
int type, olen;
unsigned long val;
struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
@@ -2171,13 +2180,13 @@ static int l2cap_parse_conf_rsp(struct l
chan->imtu = L2CAP_DEFAULT_MIN_MTU;
} else
chan->imtu = val;
- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
break;
case L2CAP_CONF_FLUSH_TO:
chan->flush_to = val;
l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
- 2, chan->flush_to);
+ 2, chan->flush_to, endptr - ptr);
break;
case L2CAP_CONF_RFC:
@@ -2191,7 +2200,7 @@ static int l2cap_parse_conf_rsp(struct l
chan->fcs = 0;
l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
- sizeof(rfc), (unsigned long) &rfc);
+ sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
break;
}
}
@@ -2250,7 +2259,7 @@ void __l2cap_connect_rsp_defer(struct l2
return;
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, buf), buf);
+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
chan->num_conf_req++;
}
@@ -2459,7 +2468,7 @@ sendresp:
u8 buf[128];
set_bit(CONF_REQ_SENT, &chan->conf_state);
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, buf), buf);
+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
chan->num_conf_req++;
}
@@ -2509,7 +2518,7 @@ static int l2cap_connect_rsp(struct l2ca
break;
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, req), req);
+ l2cap_build_conf_req(chan, req, sizeof(req)), req);
chan->num_conf_req++;
break;
@@ -2602,7 +2611,7 @@ static inline int l2cap_config_req(struc
}
/* Complete config. */
- len = l2cap_parse_conf_req(chan, rsp);
+ len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
if (len < 0) {
l2cap_send_disconn_req(conn, chan, ECONNRESET);
goto unlock;
@@ -2635,7 +2644,7 @@ static inline int l2cap_config_req(struc
if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
u8 buf[64];
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, buf), buf);
+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
chan->num_conf_req++;
}
@@ -2687,7 +2696,7 @@ static inline int l2cap_config_rsp(struc
/* throw out any old stored conf requests */
result = L2CAP_CONF_SUCCESS;
len = l2cap_parse_conf_rsp(chan, rsp->data, len,
- req, &result);
+ req, sizeof(req), &result);
if (len < 0) {
l2cap_send_disconn_req(conn, chan, ECONNRESET);
goto done;
next prev parent reply other threads:[~2017-10-09 13:01 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-09 12:30 [PATCH 3.2 00/74] 3.2.94-rc1 review Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 73/74] sched: add macros to define bitops for task atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 45/74] ubifs: Don't leak kernel memory to the MTD Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 68/74] MIPS: Refactor 'clear_page' and 'copy_page' functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 18/74] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 13/74] xhci: Limit USB2 port wake support for AMD Promontory hosts Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 41/74] powerpc/asm: Mark cr0 as clobbered in mftb() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 56/74] btrfs: preserve i_mode if __btrfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 51/74] ext3: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 12/74] udf: Fix deadlock between writeback and udf_setsize() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 39/74] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 40/74] fs/dcache.c: fix spin lockup issue on nlru->lock Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 10/74] md: don't use flush_signals in userspace processes Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 55/74] ext4: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 67/74] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 04/74] wlcore: fix 64K page support Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 30/74] drm/i915: Disable MSI for all pre-gen5 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 02/74] sched/topology: Fix building of overlapping sched-groups Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 72/74] net sched filters: fix notification of filter delete with proper handle Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 03/74] mwifiex: fixup error cases in mwifiex_add_virtual_intf() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 57/74] [media] saa7164: fix endian conversion in saa7164_bus_set() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 61/74] kvm: nVMX: Don't allow L2 to access the hardware CR8 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 06/74] perf/core: Correct event creation with PERF_FORMAT_GROUP Ben Hutchings
2017-10-09 12:30 ` Ben Hutchings [this message]
2017-10-09 12:30 ` [PATCH 3.2 49/74] ext2: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 24/74] btrfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 28/74] ipv6: always add flag an address that failed DAD with DADFAILED Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 19/74] PCI: Mark Haswell Power Control Unit as having non-compliant BARs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 34/74] s390/syscalls: Fix out of bounds arguments access Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 15/74] scsi: bnx2i: missing error code in bnx2i_ep_connect() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 60/74] nl80211: check for the required netlink attributes presence Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 53/74] reiserfs: preserve i_mode if __reiserfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 46/74] mm: fix overflow check in expand_upwards() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 43/74] Input: i8042 - fix crash at boot time Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 54/74] ext4: preserve i_mode if __ext4_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 29/74] ipv6: dad: don't remove dynamic addresses if link is down Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 23/74] Add USB quirk for HVR-950q to avoid intermittent device resets Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 38/74] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 11/74] udf: Fix races with i_size changes during readpage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 63/74] xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 58/74] [media] saa7164: fix sparse warnings Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 48/74] ext2: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 35/74] rtc: rtc-nuc900: fix loop timeout test Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 05/74] [media] mceusb: fix memory leaks in error path Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 37/74] cfg80211: Check if PMKID attribute is of expected size Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 47/74] vt: fix unchecked __put_user() in tioclinux ioctls Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 70/74] m32r: add definition of ioremap_wc to io.h Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 33/74] RDMA/uverbs: Check port number supplied by user verbs cmds Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 27/74] parisc: use compat_sys_keyctl() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 21/74] PM / Domains: Fix unsafe iteration over modified list of device links Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 22/74] MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn' Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 59/74] [media] saa7164: fix double fetch PCIe access condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 25/74] PCI/PM: Restore the status of PCI devices across hibernation Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 64/74] scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 20/74] PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 09/74] PCI: Correct PCI_STD_RESOURCE_END usage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 66/74] l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 74/74] cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 44/74] ubifs: Correctly evict xattr inodes Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 31/74] IB/core: Create common start/end port functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 36/74] tpm: fix a kernel memory leak in tpm-sysfs.c Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 71/74] m32r: add io*_rep helpers Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 01/74] sched/fair, cpumask: Export for_each_cpu_wrap() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 14/74] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 17/74] MIPS: Fix mips_atomic_set() retry condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 07/74] usb: usbip: set buffer pointers to NULL after free Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 26/74] scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 16/74] scsi: sun_esp: fix device reference leaks Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 69/74] perf/x86: Check if user fp is valid Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 62/74] video: fbdev: aty: do not leak uninitialized padding in clk to userspace Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 32/74] IB/core: Add inline function to validate port Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 52/74] reiserfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 42/74] powerpc: Fix emulation of mfocrf in emulate_step() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 08/74] usb: Fix typo in the definition of Endpoint[out]Request Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 50/74] ext3: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 15:53 ` [PATCH 3.2 00/74] 3.2.94-rc1 review Guenter Roeck
2017-10-09 17:21 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1507552234.811919105@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=ben@armis.com \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®