Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name

Commit Message

Kees Cook Oct. 11, 2023, 4:31 p.m. UTC

The code pattern of memcpy(dst, src, strlen(src)) is almost always
wrong. In this case it is wrong because it leaves memory uninitialized
if it is less than sizeof(ni->name), and overflows ni->name when longer.

Normally strtomem_pad() could be used here, but since ni->name is a
trailing array in struct hci_mon_new_index, compilers that don't support
-fstrict-flex-arrays=3 can't tell how large this array is via
__builtin_object_size(). Instead, open-code the helper and use sizeof()
since it will work correctly.

Additionally mark ni->name as __nonstring since it appears to not be a
%NUL terminated C string.

Cc: Luiz Augusto von Dentz <[e-mail]>
Cc: Edward AD <[e-mail]>
Cc: Marcel Holtmann <[e-mail]>
Cc: Johan Hedberg <[e-mail]>
Cc: "David S. Miller" <[e-mail]>
Cc: Eric Dumazet <[e-mail]>
Cc: Jakub Kicinski <[e-mail]>
Cc: Paolo Abeni <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Fixes: 78480de55a96 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event")
Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/
Signed-off-by: Kees Cook <[e-mail]>
---
 include/net/bluetooth/hci_mon.h | 2 +-
 net/bluetooth/hci_sock.c        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

Comments

[e-mail] Oct. 11, 2023, 5:09 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=792247

---Test result---

Test Summary:
CheckPatch                    PASS      0.82 seconds
GitLint                       PASS      1.86 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      41.40 seconds
CheckAllWarning               PASS      45.62 seconds
CheckSparse                   PASS      51.89 seconds
CheckSmatch                   PASS      136.78 seconds
BuildKernel32                 PASS      39.60 seconds
TestRunnerSetup               PASS      611.26 seconds
TestRunner_l2cap-tester       PASS      36.60 seconds
TestRunner_iso-tester         PASS      64.47 seconds
TestRunner_bnep-tester        PASS      12.89 seconds
TestRunner_mgmt-tester        PASS      258.17 seconds
TestRunner_rfcomm-tester      PASS      19.17 seconds
TestRunner_sco-tester         PASS      22.53 seconds
TestRunner_ioctl-tester       PASS      22.02 seconds
TestRunner_mesh-tester        PASS      15.88 seconds
TestRunner_smp-tester         PASS      17.19 seconds
TestRunner_userchan-tester    PASS      14.01 seconds
IncrementalBuild              PASS      37.07 seconds



---
Regards,
Linux Bluetooth

[e-mail] Oct. 11, 2023, 5:40 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Wed, 11 Oct 2023 09:31:44 -0700 you wrote:
> The code pattern of memcpy(dst, src, strlen(src)) is almost always
> wrong. In this case it is wrong because it leaves memory uninitialized
> if it is less than sizeof(ni->name), and overflows ni->name when longer.
> 
> Normally strtomem_pad() could be used here, but since ni->name is a
> trailing array in struct hci_mon_new_index, compilers that don't support
> -fstrict-flex-arrays=3 can't tell how large this array is via
> __builtin_object_size(). Instead, open-code the helper and use sizeof()
> since it will work correctly.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
    https://git.kernel.org/bluetooth/bluetooth-next/c/fbd34cc57479

You are awesome, thank you!

Patch

diff --git a/include/net/bluetooth/hci_mon.h b/include/net/bluetooth/hci_mon.h
index 2d5fcda1bcd0..082f89531b88 100644
--- a/include/net/bluetooth/hci_mon.h
+++ b/include/net/bluetooth/hci_mon.h
@@ -56,7 +56,7 @@  struct hci_mon_new_index {
 	__u8		type;
 	__u8		bus;
 	bdaddr_t	bdaddr;
-	char		name[8];
+	char		name[8] __nonstring;
 } __packed;
 #define HCI_MON_NEW_INDEX_SIZE 16
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 72abe54c45dd..3e7cd330d731 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -488,7 +488,8 @@  static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 		ni->type = hdev->dev_type;
 		ni->bus = hdev->bus;
 		bacpy(&ni->bdaddr, &hdev->bdaddr);
-		memcpy(ni->name, hdev->name, strlen(hdev->name));
+		memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
+			       strnlen(hdev->name, sizeof(ni->name)), '\0');
 
 		opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 		break;