All of lore.kernel.org
 help / color / mirror / Atom feed
From: patchwork-bot+bluetooth@kernel.org
To: Capsize Security <contact@capsize.online>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH] monitor: validate Return Link Keys length before parsing
Date: Wed, 28 Oct 2026 13:30:07 +0000	[thread overview]
Message-ID: <179319420706.722681.14649729121486411267.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20261027032821.1088858-1-contact@capsize.online>

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 26 Oct 2026 21:28:21 -0600 you wrote:
> return_link_keys_evt() loops i < evt->num_keys dereferencing
> keys + i*22 while the dispatcher only enforces plen >= 1.  A crafted
> btsnoop capture (evt 0x15, plen=3, num_keys=85) overflows the on-stack
> packet buffer (ASan stack-buffer-overflow in print_hexdump via
> print_link_key).
> 
> Reject payloads shorter than 1 + num_keys*22 bytes with the file's
> existing too-short-packet idiom.  No integer-overflow hazard: uint8
> promotes to int, max 1+255*22=5611.
> 
> [...]

Here is the summary with links:
  - monitor: validate Return Link Keys length before parsing
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=6475b75e7e0e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



      parent reply	other threads:[~2026-10-28 13:30 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27  3:28 [PATCH] monitor: validate Return Link Keys length before parsing Capsize Security
2026-10-27  9:07 ` bluez.test.bot
2026-10-28 13:30 ` patchwork-bot+bluetooth [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=179319420706.722681.14649729121486411267.git-patchwork-notify@kernel.org \
    --to=patchwork-bot+bluetooth@kernel.org \
    --cc=contact@capsize.online \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.