Skip to content

Commit

Permalink
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi…
Browse files Browse the repository at this point in the history
…_evt()

Check `num_rsp` before using it as for-loop counter. Add `unlock` label.

Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  • Loading branch information
peilin-ye authored and holtmann committed Jul 13, 2020
1 parent 75bbd2e commit 629b49c
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions net/bluetooth/hci_event.c
Original file line number Diff line number Diff line change
Expand Up @@ -4159,6 +4159,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
struct inquiry_info_with_rssi_and_pscan_mode *info;
info = (void *) (skb->data + 1);

if (skb->len < num_rsp * sizeof(*info) + 1)
goto unlock;

for (; num_rsp; num_rsp--, info++) {
u32 flags;

Expand All @@ -4180,6 +4183,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
} else {
struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);

if (skb->len < num_rsp * sizeof(*info) + 1)
goto unlock;

for (; num_rsp; num_rsp--, info++) {
u32 flags;

Expand All @@ -4200,6 +4206,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
}
}

unlock:
hci_dev_unlock(hdev);
}

Expand Down

0 comments on commit 629b49c

Please sign in to comment.