diff mbox series

Bluetooth: L2CAP: Fix u8 overflow

Message ID 20221118200145.1741199-1-iam@sung-woo.kim
State Accepted
Commit ae4569813a6e931258db627cdfe50dfb4f917d5d
Headers show
Series Bluetooth: L2CAP: Fix u8 overflow | expand

Commit Message

Sungwoo Kim Nov. 18, 2022, 8:01 p.m. UTC 
By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP

Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594
= Note: Bluetooth subsystem version 2.22                               0.264636
@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106
        invalid packet size (12 != 1033)
        08 00 01 00 02 01 04 00 01 10 ff ff              ............    
> ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561
        invalid packet size (14 != 1547)
        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....  
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......
= bluetoothd: Bluetooth daemon 5.43                                   14.401828
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753
        invalid packet size (12 != 1033)
        08 00 01 00 04 01 04 00 40 00 00 00              ........@...    


Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
---
 net/bluetooth/l2cap_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

bluez.test.bot@gmail.com Nov. 19, 2022, 3:07 a.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=697073

---Test result---

Test Summary:
CheckPatch                    FAIL      0.87 seconds
GitLint                       FAIL      0.52 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      33.69 seconds
BuildKernel32                 PASS      29.78 seconds
TestRunnerSetup               PASS      417.83 seconds
TestRunner_l2cap-tester       PASS      15.73 seconds
TestRunner_iso-tester         PASS      15.03 seconds
TestRunner_bnep-tester        PASS      5.37 seconds
TestRunner_mgmt-tester        PASS      103.03 seconds
TestRunner_rfcomm-tester      PASS      9.00 seconds
TestRunner_sco-tester         PASS      8.51 seconds
TestRunner_ioctl-tester       PASS      9.72 seconds
TestRunner_mesh-tester        PASS      6.64 seconds
TestRunner_smp-tester         PASS      8.41 seconds
TestRunner_userchan-tester    PASS      5.48 seconds
IncrementalBuild              PASS      30.85 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: L2CAP: Fix u8 overflow
WARNING: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#83: 
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594

total: 0 errors, 1 warnings, 0 checks, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/src/13048756.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: L2CAP: Fix u8 overflow

20: B2 Line has trailing whitespace: "        08 00 01 00 02 01 04 00 01 10 ff ff              ............    "
23: B2 Line has trailing whitespace: "        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....  "
33: B2 Line has trailing whitespace: "        08 00 01 00 04 01 04 00 40 00 00 00              ........@...    "


---
Regards,
Linux Bluetooth
bluez.test.bot@gmail.com Nov. 19, 2022, 4:36 a.m. UTC | #2 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=697073

---Test result---

Test Summary:
CheckPatch                    FAIL      0.96 seconds
GitLint                       FAIL      0.53 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      47.38 seconds
BuildKernel32                 PASS      42.25 seconds
TestRunnerSetup               PASS      575.10 seconds
TestRunner_l2cap-tester       PASS      18.91 seconds
TestRunner_iso-tester         PASS      20.00 seconds
TestRunner_bnep-tester        PASS      6.97 seconds
TestRunner_mgmt-tester        PASS      133.29 seconds
TestRunner_rfcomm-tester      PASS      11.72 seconds
TestRunner_sco-tester         PASS      10.98 seconds
TestRunner_ioctl-tester       PASS      13.25 seconds
TestRunner_mesh-tester        PASS      9.23 seconds
TestRunner_smp-tester         PASS      10.85 seconds
TestRunner_userchan-tester    PASS      7.47 seconds
IncrementalBuild              PASS      42.58 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: L2CAP: Fix u8 overflow
WARNING: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#83: 
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594

total: 0 errors, 1 warnings, 0 checks, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/src/13048756.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: L2CAP: Fix u8 overflow

20: B2 Line has trailing whitespace: "        08 00 01 00 02 01 04 00 01 10 ff ff              ............    "
23: B2 Line has trailing whitespace: "        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....  "
33: B2 Line has trailing whitespace: "        08 00 01 00 04 01 04 00 40 00 00 00              ........@...    "


---
Regards,
Linux Bluetooth
patchwork-bot+bluetooth@kernel.org Nov. 22, 2022, 12:50 a.m. UTC | #3 
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 18 Nov 2022 15:01:47 -0500 you wrote:
> By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
> multiple times and eventually it will wrap around the maximum number
> (i.e., 255).
> This patch prevents this by adding a boundary check with
> L2CAP_MAX_CONF_RSP
> 
> Btmon log:
> Bluetooth monitor ver 5.64
> = Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594
> = Note: Bluetooth subsystem version 2.22                               0.264636
> @ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191
> = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604
> @ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741
> = Open Index: 00:00:00:00:00:00                                [hci0] 13.900426
> (...)
> > ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106
>         invalid packet size (12 != 1033)
>         08 00 01 00 02 01 04 00 01 10 ff ff              ............
> > ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561
>         invalid packet size (14 != 1547)
>         0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....
> > ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390
>         invalid packet size (16 != 2061)
>         0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......
> > ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932
>         invalid packet size (16 != 2061)
>         0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......
> = bluetoothd: Bluetooth daemon 5.43                                   14.401828
> > ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753
>         invalid packet size (12 != 1033)
>         08 00 01 00 04 01 04 00 40 00 00 00              ........@...
> 
> [...]

Here is the summary with links:
  - Bluetooth: L2CAP: Fix u8 overflow
    https://git.kernel.org/bluetooth/bluetooth-next/c/ae4569813a6e

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9c24947aa..9fdede5fe 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4453,7 +4453,8 @@  static inline int l2cap_config_req(struct l2cap_conn *conn,
 
 	chan->ident = cmd->ident;
 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
-	chan->num_conf_rsp++;
+	if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
+		chan->num_conf_rsp++;
 
 	/* Reset config buffer. */
 	chan->conf_len = 0;