From nobody Sat Jun 20 17:32:53 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 084C534DCD9 for ; Sun, 12 Apr 2026 04:55:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775969719; cv=none; b=o95E4QAe9lkH9x1HBlnKdeiU6arpVRuG4oUPrvw+H23eOKB2+Os9RaKlLp65Tq9lx6RxQ6jat6+QQsAS7faC45WAdNvR6tyrM5mSLLTjOQ8Fo/+4GdkUYffqQWQ2ssN0PyJ2i5UalXUTe2Rl/ILRfdfvBc9Mz22DhZBOTzcazWs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775969719; c=relaxed/simple; bh=h67u/6cCGMsuCnoS5f8sr2GBiplSgjqdsWq+mlqVuug=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OFyPSqm9qHOAbUACeczrBAI7SohxHHuEWrLleyjTU0L2FMD4Wb93Ngk3yUBFXevrxV3NV6LIiKwAjzbAwvgj/E+P6+OWkNox08YSTYYwNGaEB6+K9k3aLToca228RMaOI21/WzQRqj0h12GgPwt7lnTCjNgRpZzrwVZJdMIVHos= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SBJkzjGR; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SBJkzjGR" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-354a18c48b5so3193622a91.1 for ; Sat, 11 Apr 2026 21:55:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775969717; x=1776574517; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QekY0/ezMpABbrLK5HXT/JhJSiKSSxHOEZGPAweniG8=; b=SBJkzjGRJtc9zzapRqDNxOOM5rJ9wT6vUvdqmKPhXJx8XxVeM/TKwR0HB0Jn6H3hs9 9MHyVssCqdA3R3wbrXs7meIbnSwjTOr1MWI4NVqJ6uAlnbyo8B8/NvMR4U76sClPV5d3 aYcnYtBUtg4dx/5SF88EPLeQ797SytBFkTO4s/tA55/Uq5+C7xdHOqRCbY0efHkRtd6F v9h5da5FpsZoQhPQXPJ5FMbdb1wnMUZNcTPJDMWwmz89pWenWazBQY6MN2qTzIh1rt8i 0QHZOkY1Uq3Vtu+3q8Mx7Jalyngc8MmIhS6/apB8Az01g98nYqORCPzVVPykeXIRNYu3 aGBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775969717; x=1776574517; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QekY0/ezMpABbrLK5HXT/JhJSiKSSxHOEZGPAweniG8=; b=edPSb6J8mV4zXxG0qSWiSc2JIQcvJL3jor6vMc5D0X6mxGMxoKnmnRmJHRbQw+PIh3 9YGNBlcNL9PuHS8nRsn1gS6TDiFQFEcxgMIxAts5YdOZNcmhRVbBzTU+Tm+PTdAVaN6L 62xMNXes8V30qXeHdcdTKpJrGK7jiBlDPQUyDbf0GZpGf3d+AJXTEAZ5EpxoP1txFnAI yXI7F9DLKr+XSY6eFSXvGXzyem7KamvwwYFQSPkLYxwuQTYkq7J/Xb7+3ov3FNW/RMFK sGp9EMRtrvnUMHWBQ2CQ7DxYuSD36ug1GNQ4Bgi5LX/jdzcJ4Vi6IzkOxoDbqoeNCJ7U EQxQ== X-Forwarded-Encrypted: i=1; AFNElJ+AeAF0jTh98bfj76HvQzvU6+okuIOifmho0uwPbVQME1ruWEOJnsBCrDdLaeR1w5AkcGjiIHNA6cy+exs=@vger.kernel.org X-Gm-Message-State: AOJu0YxIr268USYOMo6HyW21H6mxro4YDhIcHyrnJoVpRX0Wql3nCK/M iaV8IYtgOlm8aIQ2UJAU/qYb0mQlZva0XxEHADUAwIVBDC7yfFhtnr8K X-Gm-Gg: AeBDievkqAU1nY1VZquABWZ1JcJD5i0uhrDvEbDg4z232qJAG+cx9JvBEcDkuk5+tZn iGjS2p9qTPbBQY3mxxntSQhGF1EjSiQhR45N6s9i0OhD61t5adau35VZQUvrTmLD94tPrYgFvFE 7LehhgMPb4akZD5sJk39CUb6bCQteNMOG6qlzZVdEJX1rFoBw12K3f/oI/GuJijA/6CqipnAwyJ yejAd7iEjiGBDLqdDMD5CgfoDQ/Xt8vtsQOaNTkDJIlA0wASfH7TWnOfWXRL6w35MKGQMkpueg2 ZxT4e19ijaKZcNA7megmKnl165MuPNK4ivEcyDfCJk13XuC3DkCJGX63oHzmO5QQeXMaPUkRVU+ uZfIuZKs1/RHcOPLO/J7PHUP1uaxWof1A6x3s2OzRTn4S8i8T43RDCdYOivkHsw9aj8/3koEla0 J7Li7LGHhz9xMZUtUDgrU/cCMKjl5f3LukQ3wnGdpEw/AQ1/Y= X-Received: by 2002:a17:90b:5185:b0:35b:e5cf:20fc with SMTP id 98e67ed59e1d1-35e4285c0acmr9923793a91.26.1775969717304; Sat, 11 Apr 2026 21:55:17 -0700 (PDT) Received: from fedora ([61.74.238.173]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35e34ff7a64sm11792092a91.8.2026.04.11.21.55.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Apr 2026 21:55:16 -0700 (PDT) From: SeungJu Cheon To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, kees@kernel.org, kuba@kernel.org, me@brighamcampbell.com, shuah@kernel.org, linux-kernel-mentees@lists.linux.dev, linux-kernel@vger.kernel.org, SeungJu Cheon Subject: [PATCH] Bluetooth: RFCOMM: validate skb length in MCC handlers Date: Sun, 12 Apr 2026 13:54:57 +0900 Message-ID: <20260412045457.53100-1-suunj1331@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rfcomm_recv_pn(), rfcomm_recv_rpn(), rfcomm_recv_rls(), and rfcomm_recv_msc() cast skb->data to their respective structs without first checking skb->len. A remote device can send a short MCC frame, causing out-of-bounds reads from the skb buffer. For rfcomm_recv_pn(), the uninitialized pn->mtu value is stored in d->mtu via rfcomm_apply_pn(), then echoed back to the remote device in the PN response, leaking kernel heap data. This results in use of uninitialized memory, as reported by KMSAN. Add explicit skb->len checks against the expected structure size at the start of each handler before accessing the payload. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D BUG: KMSAN: uninit-value in rfcomm_run+0x7eae/0xee90 rfcomm_run+0x7eae/0xee90 kthread+0x53f/0x600 ret_from_fork+0x20f/0x910 ret_from_fork_asm+0x1a/0x30 Uninit was created at: kmem_cache_alloc_node_noprof+0x3cd/0x12d0 __alloc_skb+0x855/0x1190 vhci_write+0x125/0x960 vfs_write+0xbe1/0x15c0 ksys_write+0x1d9/0x470 __x64_sys_write+0x97/0xf0 x64_sys_call+0x2ff0/0x3ea0 do_syscall_64+0x134/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 3374 Comm: krfcommd Tainted: G W 7.0.0-= rc7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Kernel panic - not syncing: kmsan.panic set ... =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: SeungJu Cheon --- net/bluetooth/rfcomm/core.c | 40 +++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 611a9a94151e..daeba71a1514 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1431,9 +1431,15 @@ static int rfcomm_apply_pn(struct rfcomm_dlc *d, int= cr, struct rfcomm_pn *pn) =20 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff= *skb) { - struct rfcomm_pn *pn =3D (void *) skb->data; + struct rfcomm_pn *pn; struct rfcomm_dlc *d; - u8 dlci =3D pn->dlci; + u8 dlci; + + if (skb->len < sizeof(*pn)) + return -EINVAL; + + pn =3D (void *) skb->data; + dlci =3D pn->dlci; =20 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); =20 @@ -1483,8 +1489,8 @@ static int rfcomm_recv_pn(struct rfcomm_session *s, i= nt cr, struct sk_buff *skb) =20 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, stru= ct sk_buff *skb) { - struct rfcomm_rpn *rpn =3D (void *) skb->data; - u8 dlci =3D __get_dlci(rpn->dlci); + struct rfcomm_rpn *rpn; + u8 dlci; =20 u8 bit_rate =3D 0; u8 data_bits =3D 0; @@ -1495,6 +1501,12 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s,= int cr, int len, struct sk_ u8 xoff_char =3D 0; u16 rpn_mask =3D RFCOMM_RPN_PM_ALL; =20 + if (skb->len < sizeof(*rpn)) + return -EINVAL; + + rpn =3D (void *) skb->data; + dlci =3D __get_dlci(rpn->dlci); + BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xo= ffc 0x%x pm 0x%x", dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl, rpn->xon_char, rpn->xoff_char, rpn->param_mask); @@ -1589,8 +1601,14 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s,= int cr, int len, struct sk_ =20 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buf= f *skb) { - struct rfcomm_rls *rls =3D (void *) skb->data; - u8 dlci =3D __get_dlci(rls->dlci); + struct rfcomm_rls *rls; + u8 dlci; + + if (skb->len < sizeof(*rls)) + return -EINVAL; + + rls =3D (void *) skb->data; + dlci =3D __get_dlci(rls->dlci); =20 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status); =20 @@ -1608,9 +1626,15 @@ static int rfcomm_recv_rls(struct rfcomm_session *s,= int cr, struct sk_buff *skb =20 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buf= f *skb) { - struct rfcomm_msc *msc =3D (void *) skb->data; + struct rfcomm_msc *msc; struct rfcomm_dlc *d; - u8 dlci =3D __get_dlci(msc->dlci); + u8 dlci; + + if (skb->len < sizeof(*msc)) + return -EINVAL; + + msc =3D (void *) skb->data; + dlci =3D __get_dlci(msc->dlci); =20 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig); =20 --=20 2.52.0