Kees Cook c04f416730 Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name ... commit cb3871b1cd upstream. The code pattern of memcpy(dst, src, strlen(src)) is almost always wrong. In this case it is wrong because it leaves memory uninitialized if it is less than sizeof(ni->name), and overflows ni->name when longer. Normally strtomem_pad() could be used here, but since ni->name is a trailing array in struct hci_mon_new_index, compilers that don't support -fstrict-flex-arrays=3 can't tell how large this array is via __builtin_object_size(). Instead, open-code the helper and use sizeof() since it will work correctly. Additionally mark ni->name as __nonstring since it appears to not be a %NUL terminated C string. Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Cc: Edward AD <twuufnxlz@gmail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-bluetooth@vger.kernel.org Cc: netdev@vger.kernel.org Fixes: 18f547f3fc ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event") Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/ Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-10-25 12:03:16 +02:00
..
bluetooth.h	Bluetooth: Implement support for Mesh	2022-09-06 13:18:24 -07:00
hci.h	Bluetooth: fix debugfs registration	2023-06-14 11:15:28 +02:00
hci_core.h	Bluetooth: hci_core: Fix build warnings	2023-10-25 12:03:10 +02:00
hci_mon.h	Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name	2023-10-25 12:03:16 +02:00
hci_sock.h	Bluetooth: Fix HCIGETDEVINFO regression	2022-09-08 14:33:53 -07:00
hci_sync.h	Bluetooth: convert hci_update_adv_data to hci_sync	2022-08-25 16:20:30 -07:00
iso.h	Bluetooth: ISO: Add broadcast support	2022-07-22 17:14:13 -07:00
l2cap.h	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put	2022-07-26 13:35:24 -07:00
mgmt.h	Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable	2023-07-19 16:22:02 +02:00
rfcomm.h	Bluetooth: Replace zero-length array with flexible-array member	2020-02-28 08:30:02 +01:00
sco.h	Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections	2020-06-12 15:08:49 +02:00