From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 16 Feb 2010 09:34:42 -0200 From: "Gustavo F. Padovan" To: Andrei Emeltchenko Cc: linux-bluetooth@vger.kernel.org Subject: Re: [PATCH] Bluetooth: Fix kernel crash on BT stress tests. Message-ID: <20100216113408.GA15436@vigoh> References: <508e92ca1002160236k34c18949jc7d7187645ef4aa0@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: <508e92ca1002160236k34c18949jc7d7187645ef4aa0@mail.gmail.com> Sender: linux-bluetooth-owner@vger.kernel.org List-ID: Hi Andrei, * Andrei Emeltchenko [2010-02-16 12:36:47 +0200]: > From 0135f732cb45e5e91062aca84a61a40b172200a4 Mon Sep 17 00:00:00 2001 > From: Andrei Emeltchenko > Date: Tue, 16 Feb 2010 10:52:33 +0200 > Subject: [PATCH] Bluetooth: Fix kernel crash on BT stress tests. > > Added very simple check that req buffer has enough space to > fit configuration parameters. Shall be enough to reject packets > with configuration size more than req buffer. > > Crash trace below > > [ 6069.659393] Unable to handle kernel paging request at virtual > address 02000205 > [ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT > ... > [ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap] > [ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap] > ... > [ 6070.030303] Backtrace: > [ 6070.032806] [] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from > [] (l2cap_recv_frame+0x1350/0x2e78 [l2cap]) > [ 6070.043823] r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200 > [ 6070.050659] [] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from > [] (l2cap_recv_acldata+0x2bc/0x350 [l2cap]) > [ 6070.061798] [] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from > [] (hci_rx_task+0x244/0x478 [bluetooth]) > [ 6070.072631] r6:dc647700 r5:00000001 r4:df2ab740 > [ 6070.077362] [] (hci_rx_task+0x0/0x478 [bluetooth]) from > [] (tasklet_action+0x78/0xd8) > [ 6070.087005] [] (tasklet_action+0x0/0xd8) from [] Are you using ERTM or Streaming mode? If yes, I have a guess about the source of the problem. On l2cap_parse_conf_rsp we check for: while (len >= L2CAP_CONF_OPT_SIZE) { len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); But on case L2CAP_CONF_RFC olen is greater than L2CAP_CONF_OPT_SIZE we can exceed the buffer size. So the right fix will be check if len >= olen in that case. > > Signed-off-by: Andrei Emeltchenko > --- > net/bluetooth/l2cap.c | 6 ++++++ > 1 files changed, 6 insertions(+), 0 deletions(-) > > diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c > index 400efa2..69b7280 100644 > --- a/net/bluetooth/l2cap.c > +++ b/net/bluetooth/l2cap.c > @@ -2830,6 +2830,12 @@ static inline int l2cap_config_rsp(struct > l2cap_conn *conn, struct l2cap_cmd_hdr > int len = cmd->len - sizeof(*rsp); > char req[64]; > > + if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { > + BT_ERR("Config response is too big"); > + l2cap_send_disconn_req(conn, sk); > + goto done; > + } > + > /* throw out any old stored conf requests */ > result = L2CAP_CONF_SUCCESS; > len = l2cap_parse_conf_rsp(sk, rsp->data, > -- > 1.6.0.4 -- Gustavo F. Padovan http://padovan.org ProFUSION embedded systems - http://profusion.mobi