Commit 629b49c8 authored by Peilin Ye's avatar Peilin Ye Committed by Marcel Holtmann
Browse files

Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() 



Check `num_rsp` before using it as for-loop counter. Add `unlock` label.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarPeilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 75bbd2ea

net/bluetooth/hci_event.c

+7 −0
Original line number Diff line number Diff line
@@ -4159,6 +4159,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
		struct inquiry_info_with_rssi_and_pscan_mode *info;

		info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;



		for (; num_rsp; num_rsp--, info++) {

			u32 flags;
@@ -4180,6 +4183,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
	} else {

		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;



		for (; num_rsp; num_rsp--, info++) {

			u32 flags;
@@ -4200,6 +4206,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
		}

	}



unlock:

	hci_dev_unlock(hdev);

}