Hi Luiz,
> This fixes parsing of LTV entries when the length is 0.
>
> Found with:
>
> tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)"
>
> Add Advertising - Success (ScRsp only) - run
> Sending Add Advertising (0x003e)
> Test condition added, total 1
> [ 11.004577] ==================================================================
> [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0
> [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87
> [ 11.006711]
> [ 11.007176]
> [ 11.007429] Allocated by task 87:
> [ 11.008151]
> [ 11.008438] The buggy address belongs to the object at ffff888002c69580
> [ 11.008438] which belongs to the cache kmalloc-64 of size 64
> [ 11.010526] The buggy address is located 48 bytes inside of
> [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0)
> [ 11.012423] The buggy address belongs to the page:
> [ 11.013291]
> [ 11.013544] Memory state around the buggy address:
> [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
> [ 11.017010] ^
> [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
> [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 11.019116] ==================================================================
>
> Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
> ---
> net/bluetooth/mgmt.c | 3 +++
> 1 file changed, 3 insertions(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
