Files
linux/include/net
Ilia Gavrilov 5f7350ff2b Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
commit 8d59fba49362c65332395789fd82771f1028d87e upstream.

In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.

Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: db08722fc7 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-11-24 10:29:54 +01:00
..
2025-07-17 18:35:09 +02:00
2025-02-08 09:51:55 +01:00
2022-08-09 22:14:02 -07:00
2021-12-16 07:18:35 -08:00
2023-11-20 11:59:34 +01:00
2021-10-15 11:33:08 +01:00
2024-01-31 16:19:01 -08:00
2023-04-22 01:39:41 +02:00
2025-03-07 16:45:39 +01:00
2024-12-19 18:11:28 +01:00
2021-10-13 09:40:46 -07:00
2023-08-22 17:31:18 -07:00
2023-05-11 18:07:05 -07:00
2023-07-14 20:39:30 -07:00
2019-04-22 21:47:25 -07:00
2019-10-05 16:29:00 -07:00
2025-02-27 04:10:50 -08:00
2023-02-16 09:27:07 +01:00
2025-02-27 04:10:50 -08:00
2024-07-18 13:21:12 +02:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2023-11-20 11:58:56 +01:00
2023-08-02 10:58:26 +01:00
2023-07-19 09:56:49 -07:00