On Tue, Apr 23, 2019 at 12:42 PM Marcel Holtmann wrote:
>
> Hi Cong,
>
> > hci_event_packet() blindly assumes all packets are sane, at least
> > for packets allocated via vhci_get_user() path this is not true.
> > We have to check if we access skb data out-of-bound with
> > pskb_may_pull() before
Hi Cong,
> hci_event_packet() blindly assumes all packets are sane, at least
> for packets allocated via vhci_get_user() path this is not true.
> We have to check if we access skb data out-of-bound with
> pskb_may_pull() before each skb->data dereference on RX path.
>
> Reported-and-tested-by: sy
hci_event_packet() blindly assumes all packets are sane, at least
for packets allocated via vhci_get_user() path this is not true.
We have to check if we access skb data out-of-bound with
pskb_may_pull() before each skb->data dereference on RX path.
Reported-and-tested-by: syzbot+cec7a50c412a2c03f
hci_event_packet() blindly assumes all packets are sane, at least
for packets allocated via vhci_get_user() path this is not true.
We have to check if we access skb data out-of-bound with
pskb_may_pull() before each skb->data dereference on RX path.
Reported-and-tested-by: syzbot+cec7a50c412a2c03f
