[PW_SID:1074955] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt#3432
[PW_SID:1074955] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt#3432BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
…_big_complete_evt hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i < ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with num_bis=0 while BT_BOUND connections exist for that BIG handle, the loop reads beyond the valid bis_handle[] entries into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held that blocks all Bluetooth operations: Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff ... (repeats ~177 times) Bluetooth: hci0: Opcode 0x2040 failed: -110 Bluetooth: hci0: command 0x2040 tx timeout The value 0x6b6b is the KASAN slab free poison byte (0x6b), confirming reads of freed/uninitialized heap memory. Fix this by adding a bounds check on i against ev->num_bis before accessing the array. Connections beyond the reported count are cleaned up with HCI_ERROR_UNSPECIFIED to prevent the infinite loop. Fixes: a0bfde1 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable@vger.kernel.org Signed-off-by: hkbinbin <hkbinbinbin@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
5 times, most recently
from
0e0806d to
f465113
Compare
3 participants
hci_le_create_big_complete_evt() iterates over BT_BOUND connections
for a BIG handle using a while loop, accessing ev->bis_handle[i++]
on each iteration. However, there is no check that i < ev->num_bis
before the array access.
When a controller sends a LE_Create_BIG_Complete event with num_bis=0
while BT_BOUND connections exist for that BIG handle, the loop reads
beyond the valid bis_handle[] entries into adjacent heap memory.
Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX
(0x0EFF), hci_conn_set_handle() rejects them and the connection
remains in BT_BOUND state. The same connection is then found again
by hci_conn_hash_lookup_big_state(), creating an infinite loop with
hci_dev_lock held that blocks all Bluetooth operations:
Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
... (repeats ~177 times)
Bluetooth: hci0: Opcode 0x2040 failed: -110
Bluetooth: hci0: command 0x2040 tx timeout
The value 0x6b6b is the KASAN slab free poison byte (0x6b),
confirming reads of freed/uninitialized heap memory.
Fix this by adding a bounds check on i against ev->num_bis before
accessing the array. Connections beyond the reported count are
cleaned up with HCI_ERROR_UNSPECIFIED to prevent the infinite loop.
Fixes: a0bfde1 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: hkbinbin hkbinbinbin@gmail.com
net/bluetooth/hci_event.c | 6 ++++++
1 file changed, 6 insertions(+)