diff options
| author |   Dmitry Antipov <dmantipov@yandex.ru> | 2025-05-22 21:16:02 +0300 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-05-30 13:29:30 -0400 |
| commit | 03f1700b9b4d4f2fed3165370f3c23db76553178 (patch) | |
| tree | fa955cf2d48a39c9e0596e3367c1810f565b6e3b /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | net: usb: aqc111: debug info before sanitation (diff) | |
| download | wireguard-linux-03f1700b9b4d4f2fed3165370f3c23db76553178.tar.xz wireguard-linux-03f1700b9b4d4f2fed3165370f3c23db76553178.zip | |
Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed
in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data
(i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes).
Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()'
to do 'skb_put_data()' from an area beyond the one actually passed to
'mgmt_hci_cmd_sync()'.
Reported-by: syzbot+5fe2d5bfbfbec0b675a0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5fe2d5bfbfbec0b675a0
Fixes: 827af4787e74 ("Bluetooth: MGMT: Add initial implementation of MGMT_OP_HCI_CMD_SYNC")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/export-to-postgresql.py')
0 files changed, 0 insertions, 0 deletions