[PATCH BlueZ v1 0/1] shared/gatt-db: Fix incorrect attribute type

[PATCH BlueZ v1 0/1] shared/gatt-db: Fix incorrect attribute type

[Sarveshwar Bajaj]

As part of BLE GATT Fuzzing testcase,if application sends an invalid
ATT_FIND_BY_TYPE_VALUE_REQ with attribute type as CCC (UUID 0x2902).
However, this request is not valid for descriptors like CCC, as it is 
specifically intended for discovering primary services with a given UUID.
When processed in find_by_type(),attempts to access attribute->value 
without checking if attribute or attribute->value is NULL,leading to a 
segmentation fault.

Added NULL pointer checks before accessing attribute values in multiple
functions to prevent potential crashes due to invalid memory access

Bluetoothd crash dump:
0 0x73fec87ae81e  (/lib/x86_64-linux-gnu/libc.so.6+0x1ae81e)
1 0x73fec94942e9 in MemcmpInterceptorCommon(void*, int (*)
(void const*, void const*, unsigned long), void const*, 
void const*, unsigned long) 
../../../../src/libsanitizer/sanitizer_common/
sanitizer_common_interceptors.inc:881
2 0x73fec9494bc6 in __interceptor_memcmp ../../../../src/
libsanitizer/sanitizer_common
/sanitizer_common_interceptors.inc:892
3 0x73fec9494bc6 in __interceptor_memcmp ../../../../src/
libsanitizer/sanitizer_common
/sanitizer_common_interceptors.inc:887
4 0x5d5c290f2456 in find_by_type src/shared/gatt-db.c:1389
5 0x5d5c290ff855 in foreach_in_range src/shared/gatt-db.c:1549
6 0x5d5c29099752 in queue_foreach src/shared/queue.c:207
7 0x5d5c290fb085 in gatt_db_foreach_in_range src/shared/gatt-db.c:1593
8 0x5d5c290fb4ca in gatt_db_find_by_type_value src/shared/gatt-db.c:1434
9 0x5d5c290e1996 in find_by_type_val_cb src/shared/gatt-server.c:745
10 0x5d5c290c3083 in handle_notify src/shared/att.c:1015
11 0x5d5c290c3083 in can_read_data src/shared/att.c:1100
12 0x5d5c291867c1 in watch_callback src/shared/io-glib.c:157
13 0x73fec931bc43 in g_main_context_dispatch 
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43)
14 0x73fec93712b7  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xab2b7)
15 0x73fec931b2b2 in g_main_loop_run (/lib/x86_64-linux-gnu/
libglib-2.0.so.0+0x552b2)
16 0x5d5c29188518 in mainloop_run src/shared/mainloop-glib.c:66
17 0x5d5c29188e26 in mainloop_run_with_signal src/shared
/mainloop-notify.c:189
18 0x5d5c28d8c6ae in main src/main.c:1544
19 0x73fec8629d8f in __libc_start_call_main ../sysdeps/nptl/
libc_start_call_main.h:58
20 0x73fec8629e3f in __libc_start_main_impl ../csu/libc-start.c:392
21 0x5d5c28d8f4c4 in _start (/root/LE_Audio_Work/Bluez/bluez/
src/bluetoothd+0x6204c4)

Sarveshwar Bajaj (1):
  shared/gatt-db: Fix incorrect attribute type handling

 src/shared/gatt-db.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

-- 
2.34.1

[PATCH BlueZ v1 1/1] shared/gatt-db: Fix incorrect attribute type

[Sarveshwar Bajaj]

As part of BLE GATT Fuzzing testcase,if application sends an invalid
ATT_FIND_BY_TYPE_VALUE_REQ with attribute type as CCC (UUID 0x2902).
However,this request is not valid for descriptors like CCC, as it is 
specifically intended for discovering primary services with a given UUID.
When processed in find_by_type(),attempts to access attribute->value 
without checking if attribute or attribute->value is NULL,
leading to a segmentation fault.

Added NULL pointer checks before accessing attribute values in multiple
functions to prevent potential crashes due to invalid memory access

Bluetoothd crash dump:
0 0x73fec87ae81e  (/lib/x86_64-linux-gnu/libc.so.6+0x1ae81e)
1 0x73fec94942e9 in MemcmpInterceptorCommon(void*, int (*)
(void const*, void const*, unsigned long), void const*, 
void const*, unsigned long) 
../../../../src/libsanitizer/sanitizer_common/
sanitizer_common_interceptors.inc:881
2 0x73fec9494bc6 in __interceptor_memcmp ../../../../src/
libsanitizer/sanitizer_common
/sanitizer_common_interceptors.inc:892
3 0x73fec9494bc6 in __interceptor_memcmp ../../../../src/
libsanitizer/sanitizer_common
/sanitizer_common_interceptors.inc:887
4 0x5d5c290f2456 in find_by_type src/shared/gatt-db.c:1389
5 0x5d5c290ff855 in foreach_in_range src/shared/gatt-db.c:1549
6 0x5d5c29099752 in queue_foreach src/shared/queue.c:207
7 0x5d5c290fb085 in gatt_db_foreach_in_range src/shared/gatt-db.c:1593
8 0x5d5c290fb4ca in gatt_db_find_by_type_value src/shared/gatt-db.c:1434
9 0x5d5c290e1996 in find_by_type_val_cb src/shared/gatt-server.c:745
10 0x5d5c290c3083 in handle_notify src/shared/att.c:1015
11 0x5d5c290c3083 in can_read_data src/shared/att.c:1100
12 0x5d5c291867c1 in watch_callback src/shared/io-glib.c:157
13 0x73fec931bc43 in g_main_context_dispatch 
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43)
14 0x73fec93712b7  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xab2b7)
15 0x73fec931b2b2 in g_main_loop_run (/lib/x86_64-linux-gnu/
libglib-2.0.so.0+0x552b2)
16 0x5d5c29188518 in mainloop_run src/shared/mainloop-glib.c:66
17 0x5d5c29188e26 in mainloop_run_with_signal src/shared
/mainloop-notify.c:189
18 0x5d5c28d8c6ae in main src/main.c:1544
19 0x73fec8629d8f in __libc_start_call_main ../sysdeps/nptl/
libc_start_call_main.h:58
20 0x73fec8629e3f in __libc_start_main_impl ../csu/libc-start.c:392
21 0x5d5c28d8f4c4 in _start (/root/LE_Audio_Work/Bluez/bluez/
src/bluetoothd+0x6204c4)
---
 src/shared/gatt-db.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c
index fe272de34..b44140523 100644
--- a/src/shared/gatt-db.c
+++ b/src/shared/gatt-db.c
@@ -379,6 +379,9 @@ static void gen_hash_m(struct gatt_db_attribute *attr, void *user_data)
 	uint8_t *data;
 	size_t len;
 
+	if (!attr || !attr->value)
+		return;
+
 	if (bt_uuid_len(&attr->uuid) != 2)
 		return;
 
@@ -1005,6 +1008,10 @@ service_insert_characteristic(struct gatt_db_service *service,
 
 	/* Update handle of characteristic value_handle if it has changed */
 	put_le16(value_handle, &value[1]);
+
+	if (!(*chrc) || !(*chrc)->value)
+		return NULL;
+
 	if (memcmp((*chrc)->value, value, len))
 		memcpy((*chrc)->value, value, len);
 
@@ -1229,6 +1236,9 @@ service_insert_included(struct gatt_db_service *service, uint16_t handle,
 	uint16_t included_handle, len = 0;
 	int index;
 
+	if (!include || !include->value || !include->service || !service)
+		return NULL;
+
 	included = include->service;
 
 	/* Adjust include to point to the first attribute */
@@ -1386,6 +1396,9 @@ static void find_by_type(struct gatt_db_attribute *attribute, void *user_data)
 		if (search_data->value_len != attribute->value_len)
 			return;
 
+		if (!attribute || !attribute->value)
+			return;
+
 		if (memcmp(attribute->value, search_data->value,
 					search_data->value_len))
 			return;
-- 
2.34.1

RE: shared/gatt-db: Fix incorrect attribute type

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=936519

---Test result---

Test Summary:
CheckPatch                    PENDING   0.22 seconds
GitLint                       PENDING   0.22 seconds
BuildEll                      PASS      20.67 seconds
BluezMake                     PASS      1602.50 seconds
MakeCheck                     PASS      13.61 seconds
MakeDistcheck                 PASS      158.11 seconds
CheckValgrind                 PASS      214.47 seconds
CheckSmatch                   PASS      284.87 seconds
bluezmakeextell               PASS      99.24 seconds
IncrementalBuild              PENDING   0.29 seconds
ScanBuild                     PASS      884.86 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v1 0/1] shared/gatt-db: Fix incorrect attribute type

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 21 Feb 2025 22:01:38 +0530 you wrote:
> As part of BLE GATT Fuzzing testcase,if application sends an invalid
> ATT_FIND_BY_TYPE_VALUE_REQ with attribute type as CCC (UUID 0x2902).
> However, this request is not valid for descriptors like CCC, as it is
> specifically intended for discovering primary services with a given UUID.
> When processed in find_by_type(),attempts to access attribute->value
> without checking if attribute or attribute->value is NULL,leading to a
> segmentation fault.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v1,1/1] shared/gatt-db: Fix incorrect attribute type
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=4465c577778d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html