All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v8 0/1] Bluetooth: mgmt: Fix heap overflow and race condition
@ 2026-02-13  7:22 Maiquel Paiva
  2026-02-13  7:22 ` [PATCH v8 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
  0 siblings, 1 reply; 7+ messages in thread
From: Maiquel Paiva @ 2026-02-13  7:22 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, stable, Maiquel Paiva

This patch addresses two vulnerabilities in mesh handling within mgmt_util.c:
a heap buffer overflow and race conditions during list traversal.

The fixes have been consolidated into a single patch to ensure atomic
application and to follow maintainer feedback regarding the use of 
existing mutexes.

Changes in v8:
- Rebased against the latest bluetooth-fixes/master to resolve the 
  merge conflict at line 413 reported by bluez.test.bot.
- No functional changes since v7.

Changes in v5-v7:
- Combined heap overflow and race condition fixes into one patch.
- Switched to guard(mutex) using 'mgmt_pending_lock' instead of a 
  spinlock, as requested by maintainers.
- Resolved minor style and alignment issues.

Maiquel Paiva (1):
  Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling

 net/bluetooth/mgmt_util.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 7+ messages in thread
* [PATCH v5 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling
@ 2026-02-13  3:01 Maiquel Paiva
  2026-02-13  4:17 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
  0 siblings, 1 reply; 7+ messages in thread
From: Maiquel Paiva @ 2026-02-13  3:01 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, Maiquel Paiva, stable

This patch addresses two issues in mesh handling:

1. Heap buffer overflow in mgmt_mesh_add:
   The 'len' parameter wasn't being validated against the 'param' size,
   potentially leading to an overflow. Added a check to validate user
   input.

2. Race conditions in mgmt_mesh_add and mgmt_mesh_find:
   These functions modify or traverse the mesh_pending list without
   locking. Used guard(mutex) with the existing mgmt_pending_lock to
   protect the critical sections, as suggested by maintainers.

Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Cc: stable@vger.kernel.org
Signed-off-by: Maiquel Paiva <maiquelpaiva@gmail.com>
---
 net/bluetooth/mgmt_util.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index aa7b5585cb26..eee4bc05f6e5 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -397,8 +397,7 @@ struct mgmt_mesh_tx *mgmt_mesh_find(struct hci_dev *hdev, u8 handle)
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
-	if (list_empty(&hdev->mesh_pending))
-		return NULL;
+	guard(mutex)(&hdev->mgmt_pending_lock);
 
 	list_for_each_entry(mesh_tx, &hdev->mesh_pending, list) {
 		if (mesh_tx->handle == handle)
@@ -413,10 +412,15 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev,
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
+	if (len > sizeof(mesh_tx->param))
+		return NULL;
+
 	mesh_tx = kzalloc(sizeof(*mesh_tx), GFP_KERNEL);
 	if (!mesh_tx)
 		return NULL;
 
+	guard(mutex)(&hdev->mgmt_pending_lock);
+
 	hdev->mesh_send_ref++;
 	if (!hdev->mesh_send_ref)
 		hdev->mesh_send_ref++;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [PATCH v4 1/2] Bluetooth: mgmt: Fix heap overflow in mgmt_mesh_add
@ 2026-02-08  8:15 Maiquel Paiva
  2026-02-08  8:43 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
  0 siblings, 1 reply; 7+ messages in thread
From: Maiquel Paiva @ 2026-02-08  8:15 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, Maiquel Paiva, stable

Add a check for the user-provided length in mgmt_mesh_add() against
the size of the param buffer. This prevents a heap buffer overflow
if the user provides a length larger than the destination buffer.

Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Cc: stable@vger.kernel.org
Signed-off-by: Maiquel Paiva <maiquelpaiva@gmail.com>
---
 net/bluetooth/mgmt_util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index aa7b5585cb26..bdce52363332 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -413,6 +413,9 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev,
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
+	if (len > sizeof(mesh_tx->param))
+			return NULL;
+
 	mesh_tx = kzalloc(sizeof(*mesh_tx), GFP_KERNEL);
 	if (!mesh_tx)
 		return NULL;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [PATCH v3 1/2] Bluetooth: mgmt: Fix heap overflow in mgmt_mesh_add
@ 2026-02-08  6:49 Maiquel Paiva
  2026-02-08  7:57 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
  0 siblings, 1 reply; 7+ messages in thread
From: Maiquel Paiva @ 2026-02-08  6:49 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, Maiquel Paiva, stable

Add a check for the user-provided length in mgmt_mesh_add() against
the size of the param buffer. This prevents a heap buffer overflow
if the user provides a length larger than the destination buffer.

Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Cc: stable@vger.kernel.org
Signed-off-by: Maiquel Paiva <maiquelpaiva@gmail.com>
---
 net/bluetooth/mgmt_util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index aa7b5585cb26..bdce52363332 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -413,6 +413,9 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev,
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
+	if (len > sizeof(mesh_tx->param))
+			return NULL;
+
 	mesh_tx = kzalloc(sizeof(*mesh_tx), GFP_KERNEL);
 	if (!mesh_tx)
 		return NULL;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-02-20 15:56 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-13  7:22 [PATCH v8 0/1] Bluetooth: mgmt: Fix heap overflow and race condition Maiquel Paiva
2026-02-13  7:22 ` [PATCH v8 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
2026-02-13  7:48   ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
2026-02-20 15:56   ` bluez.test.bot
  -- strict thread matches above, loose matches on Subject: below --
2026-02-13  3:01 [PATCH v5 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
2026-02-13  4:17 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
2026-02-08  8:15 [PATCH v4 1/2] Bluetooth: mgmt: Fix heap overflow in mgmt_mesh_add Maiquel Paiva
2026-02-08  8:43 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot
2026-02-08  6:49 [PATCH v3 1/2] Bluetooth: mgmt: Fix heap overflow in mgmt_mesh_add Maiquel Paiva
2026-02-08  7:57 ` Bluetooth: mgmt: Fix heap overflow and race condition bluez.test.bot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.