[PATCH] Bluetooth: MSFT: validate evt_prefix_len against the response length

[PATCH] Bluetooth: MSFT: validate evt_prefix_len against the response length

[Ali Ahmet Memis]

read_supported_features() only checks that the response covers the fixed
part of struct msft_rp_read_supported_features, which is 11 bytes:

	if (skb->len < sizeof(*rp)) {
		bt_dev_err(hdev, "MSFT supported features length mismatch");
		goto failed;
	}

evt_prefix[] is a flexible array member and rp->evt_prefix_len is an
unvalidated u8 taken straight out of that response, so

	msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,
				   GFP_KERNEL);

copies up to 255 bytes from a reply that may have carried none of them.
What is copied is data the controller never sent, and it is then used to
match incoming vendor events in msft_vendor_evt().

This is not an out-of-bounds access. An skb data allocation always has
at least SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) bytes past the
payload, which is more than the 255 byte maximum, so the read stays
inside the allocation and KASAN does not report it. It is still a read
of bytes the host was never given, with the length fully controlled by
the controller.

Reject a response that is too short for the prefix it declares.

Verified with an emulated controller over /dev/vhci on a KASAN kernel,
with vhci made to advertise an MSFT opcode the way btintel, btqca, btmtk
and btrtl do unconditionally. A reply of exactly 11 bytes declaring
evt_prefix_len = 255 reaches kmemdup and copies 255 bytes
("skb->len=11 evt_prefix_len=255", with the copied buffer dumped); since
the reply ends at the fixed part, all 255 come from past the end of the
response. No KASAN report is produced, as expected from the allocation
slack described above. With this patch the response is rejected with
"MSFT event prefix length mismatch" and msft->evt_prefix is left unset.

Fixes: 145373cb1b1f ("Bluetooth: Add framework for Microsoft vendor extension")
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
---
 net/bluetooth/msft.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index d7badce8746c..ded68568e6c9 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -165,6 +165,11 @@ static bool read_supported_features(struct hci_dev *hdev,
 	if (rp->sub_opcode != MSFT_OP_READ_SUPPORTED_FEATURES)
 		goto failed;
 
+	if (skb->len < sizeof(*rp) + rp->evt_prefix_len) {
+		bt_dev_err(hdev, "MSFT event prefix length mismatch");
+		goto failed;
+	}
+
 	if (rp->evt_prefix_len > 0) {
 		msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,
 					   GFP_KERNEL);
-- 
2.55.0

RE: Bluetooth: MSFT: validate evt_prefix_len against the response length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3023 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1141853

---Test result---

Test Summary:
CheckPatch                    PASS      1.00 seconds
VerifyFixes                   PASS      0.22 seconds
VerifySignedoff               PASS      0.22 seconds
GitLint                       FAIL      0.50 seconds
SubjectPrefix                 PASS      0.21 seconds
BuildKernel                   PASS      29.37 seconds
CheckAllWarning               PASS      30.27 seconds
CheckSparse                   PASS      28.94 seconds
BuildKernel32                 PASS      26.56 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      503.60 seconds
TestRunner_l2cap-tester       PASS      65.25 seconds
TestRunner_iso-tester         PASS      89.79 seconds
TestRunner_bnep-tester        PASS      19.39 seconds
TestRunner_mgmt-tester        FAIL      221.13 seconds
TestRunner_rfcomm-tester      PASS      25.57 seconds
TestRunner_sco-tester         PASS      32.03 seconds
TestRunner_ioctl-tester       PASS      26.93 seconds
TestRunner_mesh-tester        FAIL      25.99 seconds
TestRunner_smp-tester         PASS      23.62 seconds
TestRunner_userchan-tester    PASS      20.22 seconds
TestRunner_6lowpan-tester     PASS      23.05 seconds
IncrementalBuild              PASS      25.50 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: MSFT: validate evt_prefix_len against the response length

6: B3 Line contains hard tab characters (\t): "	if (skb->len < sizeof(*rp)) {"
7: B3 Line contains hard tab characters (\t): "		bt_dev_err(hdev, "MSFT supported features length mismatch");"
8: B3 Line contains hard tab characters (\t): "		goto failed;"
9: B3 Line contains hard tab characters (\t): "	}"
14: B3 Line contains hard tab characters (\t): "	msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,"
15: B3 Line contains hard tab characters (\t): "				   GFP_KERNEL);"
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.242 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.403 seconds
Mesh - Send cancel - 2                               Timed out    1.987 seconds


https://github.com/bluez/bluetooth-next/pull/545

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: MSFT: validate evt_prefix_len against the response length

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  7 Aug 2026 01:25:54 +0000 you wrote:
> read_supported_features() only checks that the response covers the fixed
> part of struct msft_rp_read_supported_features, which is 11 bytes:
> 
> 	if (skb->len < sizeof(*rp)) {
> 		bt_dev_err(hdev, "MSFT supported features length mismatch");
> 		goto failed;
> 	}
> 
> [...]

Here is the summary with links:
  - Bluetooth: MSFT: validate evt_prefix_len against the response length
    https://git.kernel.org/bluetooth/bluetooth-next/c/78cdc6f14ab3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html