tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration. However, there is no check that i stays within ev->num_bis
before the array access.

When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory. Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state. The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.

Fix this by terminating the BIG if in case not all BIS could be setup
properly.

Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: ZhiTao Ou <hkbinbinbin@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Luiz Augusto von Dentz 5ddb8014 0beddb0c

+26 -3
+26 -3
net/bluetooth/hci_event.c
··· 7118 7118 continue; 7119 7119 } 7120 7120 7121 - if (hci_conn_set_handle(conn, 7122 - __le16_to_cpu(ev->bis_handle[i++]))) 7121 + if (ev->num_bis <= i) { 7122 + bt_dev_err(hdev, 7123 + "Not enough BIS handles for BIG 0x%2.2x", 7124 + ev->handle); 7125 + ev->status = HCI_ERROR_UNSPECIFIED; 7126 + hci_connect_cfm(conn, ev->status); 7127 + hci_conn_del(conn); 7123 7128 continue; 7129 + } 7130 + 7131 + if (hci_conn_set_handle(conn, 7132 + __le16_to_cpu(ev->bis_handle[i++]))) { 7133 + bt_dev_err(hdev, 7134 + "Failed to set BIS handle for BIG 0x%2.2x", 7135 + ev->handle); 7136 + /* Force error so BIG gets terminated as not all BIS 7137 + * could be connected. 7138 + */ 7139 + ev->status = HCI_ERROR_UNSPECIFIED; 7140 + hci_connect_cfm(conn, ev->status); 7141 + hci_conn_del(conn); 7142 + continue; 7143 + } 7124 7144 7125 7145 conn->state = BT_CONNECTED; 7126 7146 set_bit(HCI_CONN_BIG_CREATED, &conn->flags); ··· 7149 7129 hci_iso_setup_path(conn); 7150 7130 } 7151 7131 7152 - if (!ev->status && !i) 7132 + /* If there is an unexpected error or if no BISes have been connected 7133 + * for the BIG, terminate it. 7134 + */ 7135 + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) 7153 7136 /* If no BISes have been connected for the BIG, 7154 7137 * terminate. This is in case all bound connections 7155 7138 * have been closed before the BIG creation