Sungwoo Kim
ad3f7986c5
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
commit a5b862c6a2 upstream.
l2cap_le_flowctl_init() can cause both div-by-zero and an integer
overflow since hdev->le_mtu may not fall in the valid range.
Move MTU from hci_dev to hci_conn to validate MTU and stop the connection
process earlier if MTU is invalid.
Also, add a missing validation in read_buffer_size() and make it return
an error value if the validation fails.
Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a
kzalloc failure and invalid MTU value.
divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci0 hci_rx_work
RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547
Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c
89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d
b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42
RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246
RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f
RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa
R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084
R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000
FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline]
l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline]
l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline]
l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809
l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506
hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline]
hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335
worker_thread+0x926/0xe70 kernel/workqueue.c:3416
kthread+0x2e3/0x380 kernel/kthread.c:388
ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Fixes: 6ed58ec520 ("Bluetooth: Use LE buffers for LE traffic")
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-25 16:22:53 +02:00
..
2023-03-27 02:33:48 +00:00
2024-05-25 16:22:53 +02:00
2023-08-10 18:24:48 -07:00
2021-11-19 11:52:25 +00:00
2024-04-10 16:35:49 +02:00
2024-04-27 17:11:31 +02:00
2023-09-13 09:20:28 +02:00
2021-11-17 20:17:05 -08:00
2023-10-04 14:22:27 -07:00
2023-06-15 22:33:26 -07:00
2023-08-10 19:31:52 -07:00
2023-11-28 17:19:54 +00:00
2023-02-20 16:46:10 -08:00
2024-04-17 11:19:29 +02:00
2023-05-01 07:43:19 +01:00
2024-05-02 16:32:40 +02:00
2024-01-25 15:35:26 -08:00
2022-07-22 12:53:22 +01:00
2023-03-21 21:32:18 -07:00
2023-03-18 12:23:34 +00:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2023-07-28 18:06:30 -07:00
2022-11-02 20:38:13 -07:00
2022-07-22 12:53:22 +01:00
2023-08-24 10:07:13 +02:00
2021-03-26 17:43:55 +01:00
2023-08-03 08:38:07 -07:00
2022-11-16 11:31:47 +02:00
2024-04-03 15:28:54 +02:00
2024-04-03 15:28:27 +02:00
2023-01-27 11:19:46 +00:00
2021-12-22 15:03:47 -08:00
2022-07-22 12:53:22 +01:00
2023-07-14 20:39:29 -07:00
2022-07-24 18:39:17 -06:00
2023-07-27 17:17:32 -07:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2023-08-27 17:08:45 -07:00
2023-08-19 15:30:15 +01:00
2023-08-14 08:01:06 +01:00
2023-04-09 15:35:49 +01:00
2023-07-18 09:47:08 +02:00
2021-11-29 19:50:45 -08:00
2022-12-05 21:58:27 -08:00
2023-08-22 13:19:02 +02:00
2023-03-28 18:52:28 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2021-12-16 07:18:35 -08:00
2022-07-28 22:21:54 -07:00
2023-08-02 10:09:31 +01:00
2023-08-02 10:09:32 +01:00
2023-11-20 11:59:34 +01:00
2023-04-12 16:40:39 -07:00
2022-12-01 15:09:10 +01:00
2023-08-08 15:58:23 -07:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2023-12-13 18:45:10 +01:00
2022-10-31 10:43:04 +00:00
2021-01-29 20:39:14 -08:00
2024-05-17 12:02:07 +02:00
2023-06-10 00:11:41 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2023-07-28 14:07:59 -07:00
2022-07-22 12:53:22 +01:00
2021-06-28 14:29:45 -07:00
2023-08-22 21:40:40 +02:00
2023-03-23 21:51:30 +01:00
2023-12-20 17:01:45 +01:00
2022-07-22 12:53:22 +01:00
2023-08-15 13:57:51 -07:00
2023-08-14 07:06:13 +01:00
2024-04-10 16:35:42 +02:00
2022-02-07 20:12:45 -08:00
2021-10-15 11:33:08 +01:00
2023-07-14 20:39:29 -07:00
2023-08-15 13:57:51 -07:00
2024-01-31 16:19:01 -08:00
2022-12-30 07:25:52 +00:00
2022-02-17 07:00:39 -06:00
2021-11-16 13:16:54 +00:00
2024-01-01 12:42:33 +00:00
2023-07-28 11:01:56 +01:00
2022-04-25 11:40:45 +01:00
2023-10-03 09:00:40 +02:00
2024-04-17 11:19:28 +02:00
2023-04-22 01:39:41 +02:00
2024-02-05 20:14:35 +00:00
2022-09-29 07:18:00 +02:00
2022-07-22 12:53:22 +01:00
2022-10-31 20:14:27 -07:00
2024-03-01 13:35:04 +01:00
2023-09-13 07:18:04 +01:00
2023-08-22 21:40:40 +02:00
2023-06-12 21:13:23 -07:00
2021-03-23 14:14:50 -07:00
2023-08-04 15:33:17 -07:00
2023-08-04 15:33:17 -07:00
2022-07-22 12:53:22 +01:00
2023-07-20 10:46:28 +02:00
2021-10-13 09:40:46 -07:00
2024-01-31 16:19:01 -08:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2022-07-28 11:29:36 +02:00
2021-11-07 19:25:29 +00:00
2023-08-18 16:05:26 +02:00
2023-08-25 18:35:09 -07:00
2022-10-12 12:57:19 +02:00
2024-05-02 16:32:50 +02:00
2024-03-06 14:48:34 +00:00
2021-10-29 13:23:51 +01:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2023-08-22 17:31:18 -07:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2023-08-07 08:53:55 +01:00
2023-12-08 08:52:23 +01:00
2022-05-11 12:43:10 +01:00
2023-08-29 17:39:15 -07:00
2021-12-10 06:38:26 -08:00
2024-01-25 15:35:57 -08:00
2023-08-03 08:38:07 -07:00
2022-07-22 12:53:22 +01:00
2023-07-27 13:45:51 +02:00
2022-07-22 12:53:22 +01:00
2023-05-11 18:07:05 -07:00
2023-01-28 13:51:22 +01:00
2023-07-14 20:39:29 -07:00
2023-08-04 15:33:50 -07:00
2023-07-14 20:39:30 -07:00
2023-06-02 09:55:22 +01:00
2023-08-07 08:53:54 +01:00
2023-07-12 15:59:33 -07:00
2022-07-22 12:53:22 +01:00
2022-07-15 18:50:35 -07:00
2021-08-09 15:34:21 -07:00
2022-07-22 12:53:22 +01:00
2023-04-06 12:01:20 -07:00
2023-03-17 08:56:37 +00:00
2022-10-11 17:42:58 -06:00
2023-06-19 12:05:29 +02:00
2022-02-02 14:45:18 +00:00
2022-08-01 11:59:23 -07:00
2023-08-16 11:09:17 +01:00
2023-06-19 11:32:58 -07:00
2023-07-14 20:39:30 -07:00
2023-08-20 11:40:03 +01:00
2024-01-31 16:19:02 -08:00
2023-09-04 11:00:17 +01:00
2022-07-22 12:53:22 +01:00
2022-01-04 12:17:35 +00:00
2021-04-28 14:06:45 -07:00
2023-03-15 08:18:35 +00:00
2022-10-25 11:35:16 +02:00
2024-05-02 16:32:36 +02:00
2023-08-03 18:10:10 -07:00
2022-07-22 12:53:22 +01:00
2022-07-18 11:24:10 +01:00
2024-03-01 13:35:06 +01:00
2023-02-16 09:27:07 +01:00
2024-03-01 13:35:02 +01:00
2023-07-19 10:07:27 -07:00
2023-07-28 14:07:59 -07:00
2024-05-02 16:32:40 +02:00
2023-08-01 15:06:27 -07:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2023-11-20 11:58:56 +01:00
2023-08-07 08:53:55 +01:00
2023-11-20 11:58:56 +01:00
2023-08-02 10:58:26 +01:00
2023-03-18 12:23:34 +00:00
2022-07-22 12:53:22 +01:00
2024-01-31 16:19:04 -08:00
2024-01-10 17:16:54 +01:00
2023-08-03 08:38:07 -07:00
2024-05-17 12:02:20 +02:00
2023-07-19 09:56:49 -07:00