Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [bluetooth?] KASAN: slab-out-of-bounds Read in hci_sock_setsockopt | Date | Fri, 5 Apr 2024 17:49:24 +0800 |
| |
On Thu, 04 Apr 2024 23:56:28 -0700 > syzbot found the following issue on: > > HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1777929d180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e
--- x/net/bluetooth/hci_sock.c +++ y/net/bluetooth/hci_sock.c @@ -1946,7 +1946,7 @@ static int hci_sock_setsockopt_old(struc switch (optname) { case HCI_DATA_DIR: - if (copy_from_sockptr(&opt, optval, sizeof(opt))) { + if (len < sizeof(opt) || copy_from_sockptr(&opt, optval, sizeof(opt))) { err = -EFAULT; break; } --
| |