diff options
| author | Pauli Virtanen <pav@iki.fi> | 2025-10-03 22:07:32 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-11-24 12:36:08 +0300 |
| commit | 5c19daa93d9af29f1f46251b47e1ea66bcc8d679 (patch) | |
| tree | c49e3d41ffc03c1f4eef615776463dface8178ab /include | |
| parent | 01c7a6e25b9d1b70012b755400b3805bcbb1068d (diff) | |
| download | linux-5c19daa93d9af29f1f46251b47e1ea66bcc8d679.tar.xz | |
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 upstream.
There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to
memcpy from badly declared on-stack flexible array.
Another crash is in set_mesh_complete() due to double list_del via
mgmt_pending_valid + mgmt_pending_remove.
Use DEFINE_FLEX to declare the flexible array right, and don't memcpy
outside bounds.
As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free,
and also report status on error.
Fixes: 302a1f674c00d ("Bluetooth: MGMT: Fix possible UAFs")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/bluetooth/mgmt.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h index e083f0fa0113..6cf97ad15a4c 100644 --- a/include/net/bluetooth/mgmt.h +++ b/include/net/bluetooth/mgmt.h @@ -847,7 +847,7 @@ struct mgmt_cp_set_mesh { __le16 window; __le16 period; __u8 num_ad_types; - __u8 ad_types[]; + __u8 ad_types[] __counted_by(num_ad_types); } __packed; #define MGMT_SET_MESH_RECEIVER_SIZE 6 |