public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v6 0/1] mgmt: Fix heap overflow and race condition
@ 2026-02-13  5:15 Maiquel Paiva
  2026-02-13  5:15 ` [PATCH v6 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
  0 siblings, 1 reply; 5+ messages in thread
From: Maiquel Paiva @ 2026-02-13  5:15 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, Maiquel Paiva

This patch resolves two vulnerabilities in mgmt_util.c:
1. A heap buffer overflow due to missing length validation.
2. Race conditions in list handling, fixed using the existing mutex.

Changes in v6:
- Rebased patch onto the latest bluetooth-next tree to 
  resolve CI bot apply errors.
- No logical changes from v5.

Changes in v5:
- Combined both fixes into a single patch for atomic application.
- Switched to using 'mgmt_pending_lock' (mutex).

Maiquel Paiva (1):
  Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling

 net/bluetooth/mgmt_util.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 5+ messages in thread
* [PATCH bluetooth v7 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling
@ 2026-02-13  6:04 Maiquel Paiva
  2026-02-13  6:55 ` mgmt: Fix heap overflow and race condition bluez.test.bot
  2026-02-20 15:56 ` bluez.test.bot
  0 siblings, 2 replies; 5+ messages in thread
From: Maiquel Paiva @ 2026-02-13  6:04 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: luiz.dentz, gregkh, marcel, Maiquel Paiva, stable

This patch addresses two issues in mesh handling:

1. Heap buffer overflow in mgmt_mesh_add:
   The 'len' parameter wasn't being validated against the 'param' size,
   potentially leading to an overflow. Added a check to validate user
   input.

2. Race conditions in mgmt_mesh_add and mgmt_mesh_find:
   These functions modify or traverse the mesh_pending list without
   locking. Used guard(mutex) with the existing mgmt_pending_lock to
   protect the critical sections, as suggested by maintainers.

Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Cc: stable@vger.kernel.org
Signed-off-by: Maiquel Paiva <maiquelpaiva@gmail.com>
---
 net/bluetooth/mgmt_util.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index aa7b5585cb26..eee4bc05f6e5 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -397,8 +397,7 @@ struct mgmt_mesh_tx *mgmt_mesh_find(struct hci_dev *hdev, u8 handle)
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
-	if (list_empty(&hdev->mesh_pending))
-		return NULL;
+	guard(mutex)(&hdev->mgmt_pending_lock);
 
 	list_for_each_entry(mesh_tx, &hdev->mesh_pending, list) {
 		if (mesh_tx->handle == handle)
@@ -413,10 +412,15 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev,
 {
 	struct mgmt_mesh_tx *mesh_tx;
 
+	if (len > sizeof(mesh_tx->param))
+		return NULL;
+
 	mesh_tx = kzalloc(sizeof(*mesh_tx), GFP_KERNEL);
 	if (!mesh_tx)
 		return NULL;
 
+	guard(mutex)(&hdev->mgmt_pending_lock);
+
 	hdev->mesh_send_ref++;
 	if (!hdev->mesh_send_ref)
 		hdev->mesh_send_ref++;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-02-20 15:56 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-13  5:15 [PATCH v6 0/1] mgmt: Fix heap overflow and race condition Maiquel Paiva
2026-02-13  5:15 ` [PATCH v6 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
2026-02-13  5:44   ` mgmt: Fix heap overflow and race condition bluez.test.bot
  -- strict thread matches above, loose matches on Subject: below --
2026-02-13  6:04 [PATCH bluetooth v7 1/1] Bluetooth: mgmt: Fix heap overflow and race condition in mesh handling Maiquel Paiva
2026-02-13  6:55 ` mgmt: Fix heap overflow and race condition bluez.test.bot
2026-02-20 15:56 ` bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox