Check upon `num_rsp` is insufficient. A malformed event packet with a large `num_rsp` number makes hci_extended_inquiry_result_evt() go out of bounds. Fix it. Also, make `num_rsp` unsigned. This patch fixes the following syzbot bug: https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2 Reported-by: syzbot+d8489a79b781849b9c46@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Peilin Ye <yepeilin.cs@xxxxxxxxx> --- net/bluetooth/hci_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 03a0759f2fc2..29aff5e7dec2 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4369,13 +4369,13 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) { struct inquiry_data data; - struct extended_inquiry_info *info = (void *) (skb->data + 1); - int num_rsp = *((__u8 *) skb->data); + struct extended_inquiry_info *info = (void *)(skb->data + 1); + __u8 num_rsp = *((__u8 *)skb->data); size_t eir_len; BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - if (!num_rsp) + if (!num_rsp || num_rsp * sizeof(*info) > skb->truesize) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) -- 2.25.1