Kees Cook
b849a38e18
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name ...
commit cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 upstream.
The code pattern of memcpy(dst, src, strlen(src)) is almost always
wrong. In this case it is wrong because it leaves memory uninitialized
if it is less than sizeof(ni->name), and overflows ni->name when longer.
Normally strtomem_pad() could be used here, but since ni->name is a
trailing array in struct hci_mon_new_index, compilers that don't support
-fstrict-flex-arrays=3 can't tell how large this array is via
__builtin_object_size(). Instead, open-code the helper and use sizeof()
since it will work correctly.
Additionally mark ni->name as __nonstring since it appears to not be a
%NUL terminated C string.
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Edward AD <twuufnxlz@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: netdev@vger.kernel.org
Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event")
Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-25 11:53:25 +02:00
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
2023-10-25 11:53:25 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nf_tables: report use refcount overflow
2023-08-16 18:19:24 +02:00
xfrm: fix a data-race in xfrm_gen_index()
2023-10-25 11:53:21 +02:00
nfc: constify several pointers to u8, char and sk_buff
2023-07-27 08:37:07 +02:00
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
2023-03-11 16:44:11 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
2022-08-03 11:59:39 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
2023-06-14 10:59:58 +02:00
bonding: fix macvlan over alb bond support
2023-08-30 16:27:24 +02:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:27:42 +02:00
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
2023-08-16 18:19:24 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: Remove unused inline function dst_hold_and_use()
2023-06-21 15:44:12 +02:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-26 18:03:12 +02:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
ipv6: fix locking issues with loops over idev->addr_list
2022-06-14 18:11:25 +02:00
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
2021-03-30 14:35:26 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
2023-06-05 08:17:33 +02:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2023-05-30 12:44:05 +01:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: use DEV_STATS_INC()
2023-09-23 10:59:59 +02:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
tcp: Reduce chance of collisions in inet6_hashfn().
2023-08-11 11:53:47 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-23 10:59:42 +02:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
neighbour: delete neigh_lookup_nodev as not used
2023-06-21 15:44:12 +02:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
net/sched: make psched_mtu() RTNL-less safe
2023-07-27 08:37:33 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
net: validate veth and vxcan peer ifindexes
2023-08-30 16:27:24 +02:00
net/sched: sch_taprio: fix possible use-after-free
2023-02-06 07:52:37 +01:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
sock: annotate data-races around prot->memory_pressure
2023-08-30 16:27:23 +02:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp: fix excessive TLP and RACK timeouts from HZ rounding
2023-10-25 11:53:21 +02:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
vxlan: calculate correct header length for GPE
2023-08-11 11:53:47 +02:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
b849a38e18