Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [bluetooth?] KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt | Date | Fri, 5 Apr 2024 18:06:20 +0800 |
| |
On Thu, 04 Apr 2024 23:55:25 -0700 > syzbot found the following issue on: > > HEAD commit: 707081b61156 Merge branch 'for-next/core', remote-tracking.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c6098d180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e
--- x/net/bluetooth/l2cap_sock.c +++ y/net/bluetooth/l2cap_sock.c @@ -960,7 +960,7 @@ static int l2cap_sock_setsockopt(struct break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { + if (optlen < sizeof(u32) || copy_from_sockptr(&opt, optval, sizeof(u32))) { err = -EFAULT; break; } --
| |