mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-13 14:14:37 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/bluetooth
History
Harshit Mogalapalli 2185e0fdbb Bluetooth: Fix a buffer overflow in mgmt_mesh_add() 
Smatch Warning:
net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy()
'mesh_tx->param' too small (48 vs 50)

Analysis:

'mesh_tx->param' is array of size 48. This is the destination.
u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48.

But in the caller 'mesh_send' we reject only when len > 50.
len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.

Fixes: b338d91703 ("Bluetooth: Implement support for Mesh")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Brian Gix <brian.gix@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2023-01-17 15:50:10 -08:00
..
bnep bluetooth: Use netif_rx(). 2022-03-07 11:40:41 +00:00
cmtp Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2022-01-17 05:49:30 +02:00
hidp Bluetooth: move from strlcpy with unused retval to strscpy 2022-08-25 16:26:18 -07:00
rfcomm Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() 2022-12-12 14:19:26 -08:00
6lowpan.c iov_iter work; most of that is about getting rid of 2022-12-12 18:29:54 -08:00
a2mp.c use less confusing names for iov_iter direction initializers 2022-11-25 13:01:55 -05:00
a2mp.h
af_bluetooth.c Bluetooth: Fix not cleanup led when bt_init fails 2022-12-02 13:09:31 -08:00
amp.c
amp.h
aosp.c Bluetooth: Fix null pointer deref on unexpected status event 2022-08-08 17:04:37 -07:00
aosp.h Bluetooth: aosp: Support AOSP Bluetooth Quality Report 2021-11-02 19:37:52 +01:00
ecdh_helper.c
ecdh_helper.h
eir.c Bluetooth: Add initial implementation of BIS connections 2022-07-22 17:13:56 -07:00
eir.h Bluetooth: Add initial implementation of BIS connections 2022-07-22 17:13:56 -07:00
hci_codec.c Bluetooth: Fix support for Read Local Supported Codecs V2 2022-12-02 13:09:31 -08:00
hci_codec.h Bluetooth: Add support for Read Local Supported Codecs V2 2021-09-07 14:09:18 -07:00
hci_conn.c Bluetooth: hci_conn: Fix crash on hci_create_cis_sync 2022-12-12 14:19:25 -08:00
hci_core.c Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() 2022-12-12 14:19:26 -08:00
hci_debugfs.c Bluetooth: hci_sync: Fix not able to set force_static_address 2022-12-12 14:19:23 -08:00
hci_debugfs.h Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c 2021-09-22 16:17:13 +02:00
hci_event.c Bluetooth: Wait for HCI_OP_WRITE_AUTH_PAYLOAD_TO to complete 2022-12-12 14:19:26 -08:00
hci_request.c Bluetooth: silence a dmesg error message in hci_request.c 2022-12-02 13:09:30 -08:00
hci_request.h Bluetooth: Move hci_abort_conn to hci_conn.c 2022-08-31 15:45:56 -07:00
hci_sock.c Bluetooth: Prevent double register of suspend 2022-09-28 12:16:10 -07:00
hci_sync.c Bluetooth: Add quirk to disable MWS Transport Configuration 2022-12-12 14:19:24 -08:00
hci_sysfs.c Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times 2022-09-21 15:00:54 -07:00
iso.c Bluetooth: ISO: Avoid circular locking dependency 2022-12-12 14:19:26 -08:00
Kconfig Bluetooth: Add CONFIG_BT_LE_L2CAP_ECRED 2022-12-12 14:19:24 -08:00
l2cap_core.c Bluetooth: Add CONFIG_BT_LE_L2CAP_ECRED 2022-12-12 14:19:24 -08:00
l2cap_sock.c Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() 2022-01-07 08:40:11 +01:00
leds.c
leds.h
lib.c Bluetooth: Fix EALREADY and ELOOP cases in bt_status() 2022-12-12 14:19:24 -08:00
Makefile Bluetooth: Add BTPROTO_ISO socket type 2022-07-22 17:13:39 -07:00
mgmt.c Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
mgmt_config.c Bluetooth: mgmt: Use the correct print format 2021-06-26 07:12:42 +02:00
mgmt_config.h
mgmt_util.c Bluetooth: Implement support for Mesh 2022-09-06 13:18:24 -07:00
mgmt_util.h Bluetooth: Fix a buffer overflow in mgmt_mesh_add() 2023-01-17 15:50:10 -08:00
msft.c Bluetooth: Fix null pointer deref on unexpected status event 2022-08-08 17:04:37 -07:00
msft.h Bluetooth: hci_sync: Refactor remove Adv Monitor 2022-07-21 17:14:55 -07:00
sco.c Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk 2022-05-13 13:05:48 +02:00
selftest.c
selftest.h
smp.c use less confusing names for iov_iter direction initializers 2022-11-25 13:01:55 -05:00
smp.h