From nobody Mon Jun 8 15:36:59 2026 Received: from mail-pg1-f194.google.com (mail-pg1-f194.google.com [209.85.215.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 900F43B0AE7 for ; Thu, 28 May 2026 09:45:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.194 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779961514; cv=none; b=ArIlREj9VZoGi18m1Zu2Q6eyl5AeKZGIk//SNpybLuYreXC26UUYXl0yinoORMHVVXoqfN+kRP8Ar6ZQyaAJy5jYPp0n21N6iK82KN2D69aTJ/2u7qesK/zHF4pwYTd8scR3P+37SKiTGHsQluO+qTZiTYKnxG9ij6seIXCNetc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779961514; c=relaxed/simple; bh=IfbBa6mGkbkRWI0hlfFucfNIljPfTM3OpI3kTgA/dpc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Kzjevz5UAKplTMT3ThqDtz1LXgndiCjnstd3iZ8y1vU0REF4ME1Oqjdy48BoPG2vIKWYOzvsVDXM1lXZH8W1fH0c2/ut3iggXGZ87PUu/esLd2Qb+vtSE4axoF/+0RMddysE8dHCndfNoGLtalqTdQ/URgy/7XAD8KxDpUc0ZCU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TT+lcFTY; arc=none smtp.client-ip=209.85.215.194 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TT+lcFTY" Received: by mail-pg1-f194.google.com with SMTP id 41be03b00d2f7-c8016d642b2so5585176a12.0 for ; Thu, 28 May 2026 02:45:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779961512; x=1780566312; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yBDHnHhRFcY/lY+WGqOKtRwJwLgBPCUwv4P0vLy9mdg=; b=TT+lcFTYq4UqjMYVJIRjfcAbi0BCPWdW9hza91ugup17b3CEySmTB0d93yM5ITpSxs Fw2I4DjvB3lUmx/GHj/yUN3+SqISD2jOyxesCiBCG0ijdZhTSSYNeRmNvK5/YX15n/54 3YkPMKjUwif6NVzCV19q/aRbkFrkaXDCIvZq5rAE637WkCJnVQQgHGH3s83nM9g68lyn wb4grpKpU4x1W+75I4p3ikrA6UwchYsmFMFx+E1XUV10GECk41vNdpK8LQ4nUs908tzk 5ZM7oScFMHKYvR4gfZTUrh86j06HIq9ewDCn6F1y2EivNqnkN8qv+T7UYbOdrDko4fOZ 6bQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779961512; x=1780566312; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yBDHnHhRFcY/lY+WGqOKtRwJwLgBPCUwv4P0vLy9mdg=; b=IG8m0ol+Sxwa+VksHJZYXSATlEuqgJFHRzq541pCpnKUbYsBqiD2yalnnx6WVBtB9u UNltgVVxTBU58vur+ZLWMFmEIiIkRJfP7DNnvfHSobqyc2I3ogOT2skrun8L5KJ7YJKX XCaFgtisKCSHmTO32EGE+qE+AXkTNJ8TUM52SL4fd2Vxg8xxEhIzpRJunmsC7aY91c4s 1KhNHX7hRSqM+4VX7Q+7PvAgUxzF7Scvw/o9oY7MAw06m67jzAbclDJ4K0kxzEbizAmk 4Ps0Ac15TMyfvtpzFLP7g/HiTfAV6NmLG3/e3YWIlv5gS5g+MDNN9m26s7CV1+EaIMvs Ir5A== X-Forwarded-Encrypted: i=1; AFNElJ/7N1phS/4okVRdS/N68GY0mq01A1Z7EwFpJJZW3QjZOXCmpFWU7qwNUbJIi1duDGBpTEZ7CGrVBdyZxWk=@vger.kernel.org X-Gm-Message-State: AOJu0Yw/yvKwKSKmZPTM2m642eNDMNR53oCaTfyVxnsXghG5t3lFH30c VU8cj3VPAZLSOtfibv9W2OG0y4nqYvTZjBTxwOMKa3k8QWjw0qWDdQqM X-Gm-Gg: Acq92OFh6fXrnXBJzibTZcR2mxecng3D2EDZTlq3sseEGFMXdqQUz7ST/bNxiM1WDUS 4qAUtkR+19PBLxJcbMRcmPD9LHYc37UgWRNa7tK2wtY43rHmw3D3UYqN/MfcqQ3226l9bhDxUUG Sz1zXyh5rqL+9I78mYorbXg7jJWtcUZ3bn5YJHyHmVDEZvd+mxf1CWZRtAnErugqdcTgVI/eGxp Q0TdLGwzI1yq1fT3tAbotNFki5v7YfP7V0F+/W4M+AvApvO4CB1gzerJPU3oGzS+s1vqRAbbE6X S5Y81LJ+lja6UVUKH2D/NxbMfAM26I+Y3P9nM156Vi2dOVAl+U3MQx5zR3z2fC+CNL12DVpvT5y qLasQAHDFAmI5xPtS+s6OH2qqtj+bpokdnh418o3EAVHdP5O4haj5Wcx1R4gLIv5Ax0EqAzmBUi oMq87QYuSvLV6uX+k2X+kn4zh78arFk7WLVjKn+rKDzw== X-Received: by 2002:a05:6a21:48a:b0:3b3:23b4:6950 with SMTP id adf61e73a8af0-3b4024e00e6mr398772637.18.1779961511853; Thu, 28 May 2026 02:45:11 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-841d70ba03fsm5314756b3a.33.2026.05.28.02.45.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 May 2026 02:45:11 -0700 (PDT) From: Zhang Cen To: Marcel Holtmann , Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Menzel , zerocling0077@gmail.com, 2045gemini@gmail.com, Zhang Cen Subject: [PATCH v3] Bluetooth: MGMT: validate advertising TLV before type checks Date: Thu, 28 May 2026 17:45:06 +0800 Message-Id: <20260528094506.3699804-1-rollkingzzc@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer. A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data. KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path: BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg() Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1]. Fixes: 2bb36870e8cb ("Bluetooth: Unify advertising instance flags check") Reviewed-by: Paul Menzel Signed-off-by: Zhang Cen --- v3: - Move the KASAN excerpt earlier in the commit message. - Add Reviewed-by from Paul Menzel. net/bluetooth/mgmt.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index de5bd6b637b20..027b266ccc747 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -8638,6 +8638,12 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, = u32 adv_flags, u8 *data, if (!cur_len) continue; =20 + /* If the current field length would exceed the total data + * length, then it's invalid. + */ + if (i + cur_len >=3D len) + return false; + if (data[i + 1] =3D=3D EIR_FLAGS && (!is_adv_data || flags_managed(adv_flags))) return false; @@ -8654,12 +8660,6 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, = u32 adv_flags, u8 *data, if (data[i + 1] =3D=3D EIR_APPEARANCE && appearance_managed(adv_flags)) return false; - - /* If the current field length would exceed the total data - * length, then it's invalid. - */ - if (i + cur_len >=3D len) - return false; } =20 return true; --=20 2.43.0