[PATCH] Bluetooth: hci_sock: fix negative cookie IDA free and short event OOB read

[PATCH] Bluetooth: hci_sock: fix negative cookie IDA free and short event OOB read

[Hui Peng]

In hci_sock_release(), check hci_pi(sk)->cookie > 0 before calling
ida_free(&sock_cookie_ida, ...) so an unallocated or error cookie does
not trigger a negative IDA index warning, and in hci_sock_sendmsg() /
hci_send_to_channel(), validate skb->len before reading HCI event
headers.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 070ca388f9ac..ab960cf2efb2 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -115,7 +115,7 @@ static void hci_sock_free_cookie(struct sock *sk)
 {
 	int id = hci_pi(sk)->cookie;
 
-	if (id) {
+	if (id > 0) {
 		hci_pi(sk)->cookie = 0;
 		ida_free(&sock_cookie_ida, id);
 	}
@@ -177,6 +177,9 @@ static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
 	if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT)
 		return false;
 
+	if (skb->len < HCI_EVENT_HDR_SIZE)
+		return true;
+
 	flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 
 	if (!hci_test_bit(flt_event, &flt->event_mask))
@@ -187,11 +190,13 @@ static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
 		return false;
 
 	if (flt_event == HCI_EV_CMD_COMPLETE &&
-	    flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
+	    (skb->len < 5 ||
+	     flt->opcode != get_unaligned((__le16 *)(skb->data + 3))))
 		return true;
 
 	if (flt_event == HCI_EV_CMD_STATUS &&
-	    flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
+	    (skb->len < 6 ||
+	     flt->opcode != get_unaligned((__le16 *)(skb->data + 4))))
 		return true;
 
 	return false;

RE: Bluetooth: hci_sock: fix negative cookie IDA free and short event OOB read

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 846 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: patch failed: net/bluetooth/hci_sock.c:177
error: net/bluetooth/hci_sock.c: patch does not apply
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth