[PATCH] monitor: validate Return Link Keys length before parsing

[PATCH] monitor: validate Return Link Keys length before parsing

[Capsize Security]

return_link_keys_evt() loops i < evt->num_keys dereferencing
keys + i*22 while the dispatcher only enforces plen >= 1.  A crafted
btsnoop capture (evt 0x15, plen=3, num_keys=85) overflows the on-stack
packet buffer (ASan stack-buffer-overflow in print_hexdump via
print_link_key).

Reject payloads shorter than 1 + num_keys*22 bytes with the file's
existing too-short-packet idiom.  No integer-overflow hazard: uint8
promotes to int, max 1+255*22=5611.

Verified: pristine HEAD btmon + crafted capture -> ASan
stack-buffer-overflow; patched btmon -> 'too short packet', exit 0,
ASan-clean.  Boundary matrix (valid 1-key, zero keys, exact-fit 2-key,
short-by-one, num_keys=255) all exit 0 ASan-clean.  make check passes
on the scratch build.

Fixes: 7d103ce15295 ("monitor: Add support for decoding the return link keys event")
Assisted-by: Muse-Code:muse-spark
---
 monitor/packet.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/monitor/packet.c b/monitor/packet.c
index a301e1ae7..e51cf7bb0 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -12224,6 +12224,11 @@ static void return_link_keys_evt(struct timeval *tv, uint16_t index,
 
 	print_field("Num keys: %d", evt->num_keys);
 
+	if (size < 1u + (unsigned int) evt->num_keys * 22u) {
+		print_text(COLOR_ERROR, "too short packet");
+		return;
+	}
+
 	for (i = 0; i < evt->num_keys; i++) {
 		print_bdaddr(evt->keys + (i * 22));
 		print_link_key(evt->keys + (i * 22) + 6);
-- 
2.47.3

RE: monitor: validate Return Link Keys length before parsing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3636 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1194227/

---Test result---

Test Summary:
CheckPatch                    PASS      1.20 seconds
GitLint                       PASS      0.35 seconds
BuildEll                      PASS      19.54 seconds
BluezMake                     PASS      299.81 seconds
MakeCheck                     PASS      0.89 seconds
MakeDistcheck                 PASS      141.88 seconds
CheckValgrind                 PASS      145.09 seconds
CheckSmatch                   WARNING   291.45 seconds
bluezmakeextell               PASS      93.44 seconds
TestFunctional                FAIL      1147.42 seconds
IncrementalBuild              PASS      302.65 seconds
ScanBuild                     PASS      1160.84 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2289:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3925:52: warning: array of flexible structuresmonitor/bt.h:3913:40: warning: array of flexible structures
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bluetoothctl::test_bluetoothctl_pair_bredr[hosts15-vm2]: pytest_bluezenv.rpc.RemoteError: <pexpect.popen_spawn.PopenSpawn object at 0x7f363325a510>
    searcher: searcher_re:
        0: re.compile(b'Changing pairable on succeeded')
    <pexpect.popen_spawn.PopenSpawn object at 0x7f363325a510>
    searcher: searcher_re:
        0: re.compile(b'Changing pairable on succeeded')
    Remote traceback:
        Traceback (most recent call last):
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/rpc.py", line 102, in server_stream
            result = method(*msg["a"], **msg["kw"])
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/env.py", line 256, in call_plugin
            return getattr(self.plugins[name], method)(*a, **kw)
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/host_plugins.py", line 502, in expect
            ret = self.ctl.expect(*a, **kw)
          File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 354, in expect
            return self.expect_list(compiled_pattern_list,
                   ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
                    timeout, searchwindowsize, async_)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
          File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 383, in expect_list
            return exp.expect_loop(timeout)
                   ~~~~~~~~~~~~~~~^^^^^^^^^
          File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 181, in expect_loop
            return self.timeout(e)
                   ~~~~~~~~~~~~^^^
          File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 144, in timeout
            raise exc
        pexpect.exceptions.TIMEOUT: <pexpect.popen_spawn.PopenSpawn object at 0x7f363325a510>
        searcher: searcher_re:
            0: re.compile(b'Changing pairable on succeeded')
        <pexpect.popen_spawn.PopenSpawn object at 0x7f363325a510>
        searcher: searcher_re:
            0: re.compile(b'Changing pairable on succeeded')


https://github.com/bluez/bluez/pull/2717

---
Regards,
Linux Bluetooth

Re: [PATCH] monitor: validate Return Link Keys length before parsing

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 26 Oct 2026 21:28:21 -0600 you wrote:
> return_link_keys_evt() loops i < evt->num_keys dereferencing
> keys + i*22 while the dispatcher only enforces plen >= 1.  A crafted
> btsnoop capture (evt 0x15, plen=3, num_keys=85) overflows the on-stack
> packet buffer (ASan stack-buffer-overflow in print_hexdump via
> print_link_key).
> 
> Reject payloads shorter than 1 + num_keys*22 bytes with the file's
> existing too-short-packet idiom.  No integer-overflow hazard: uint8
> promotes to int, max 1+255*22=5611.
> 
> [...]

Here is the summary with links:
  - monitor: validate Return Link Keys length before parsing
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=6475b75e7e0e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html