linux-next: manual merge of the bluetooth tree with the origin tree

[Mark Brown]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/bnep/core.c

between commits:

  59e932ded949f ("Bluetooth: bnep: Fix UAF read of dev->name")
  72b8deccff17a ("Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling")

from the origin tree and commits:

  feaef2aa27201 ("Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling")
  ffeee619a13bf ("Bluetooth: bnep: Fix UAF read of dev->name")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/bnep/core.c
index 0de5df690bd0b,5c5f53ff30e8e..0000000000000
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@@ -206,14 -206,11 +206,11 @@@ static int bnep_ctrl_set_mcfilter(struc
  	return 0;
  }
  
- static int bnep_rx_control(struct bnep_session *s, void *data, int len)
+ static int bnep_rx_control_cmd(struct bnep_session *s, u8 cmd, void *data,
+ 			       int len)
  {
- 	u8  cmd = *(u8 *)data;
  	int err = 0;
  
- 	data++;
- 	len--;
- 
  	switch (cmd) {
  	case BNEP_CMD_NOT_UNDERSTOOD:
  	case BNEP_SETUP_CONN_RSP:
@@@ -254,6 -251,14 +251,14 @@@
  	return err;
  }
  
+ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
+ {
+ 	if (len < 1)
+ 		return -EILSEQ;
+ 
+ 	return bnep_rx_control_cmd(s, *(u8 *)data, data + 1, len - 1);
+ }
+ 
  static int bnep_rx_extension(struct bnep_session *s, struct sk_buff *skb)
  {
  	struct bnep_ext_hdr *h;
@@@ -299,19 -304,26 +304,26 @@@ static int bnep_rx_frame(struct bnep_se
  {
  	struct net_device *dev = s->dev;
  	struct sk_buff *nskb;
+ 	u8 *data;
  	u8 type, ctrl_type;
  
  	dev->stats.rx_bytes += skb->len;
  
- 	type = *(u8 *) skb->data;
- 	skb_pull(skb, 1);
- 	ctrl_type = *(u8 *)skb->data;
+ 	data = skb_pull_data(skb, sizeof(type));
+ 	if (!data)
+ 		goto badframe;
+ 	type = *data;
  
  	if ((type & BNEP_TYPE_MASK) >= sizeof(__bnep_rx_hlen))
  		goto badframe;
  
  	if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
- 		if (bnep_rx_control(s, skb->data, skb->len) < 0) {
+ 		data = skb_pull_data(skb, sizeof(ctrl_type));
+ 		if (!data)
+ 			goto badframe;
+ 		ctrl_type = *data;
+ 
+ 		if (bnep_rx_control_cmd(s, ctrl_type, skb->data, skb->len) < 0) {
  			dev->stats.tx_errors++;
  			kfree_skb(skb);
  			return 0;
@@@ -324,24 -336,27 +336,31 @@@
  
  		/* Verify and pull ctrl message since it's already processed */
  		switch (ctrl_type) {
- 		case BNEP_SETUP_CONN_REQ:
- 			/* Pull: ctrl type (1 b), len (1 b), data (len bytes) */
- 			if (!skb_pull(skb, 2 + *(u8 *)(skb->data + 1) * 2))
+ 		case BNEP_SETUP_CONN_REQ: {
+ 			u8 uuid_size;
+ 
+ 			/* Pull uuid_size and the dst/src service UUIDs. */
+ 			data = skb_pull_data(skb, sizeof(uuid_size));
+ 			if (!data)
+ 				goto badframe;
+ 			uuid_size = *data;
+ 			if (!skb_pull(skb, uuid_size + uuid_size))
  				goto badframe;
  			break;
+ 		}
  		case BNEP_FILTER_MULTI_ADDR_SET:
 -		case BNEP_FILTER_NET_TYPE_SET:
 -			/* Pull: len (2 b), data (len bytes) */
 -			data = skb_pull_data(skb, sizeof(u16));
 -			if (!data)
 +		case BNEP_FILTER_NET_TYPE_SET: {
 +			u8 *hdr;
 +
 +			/* Pull ctrl type (1 b) + len (2 b) */
 +			hdr = skb_pull_data(skb, 3);
 +			if (!hdr)
  				goto badframe;
 -			if (!skb_pull(skb, get_unaligned_be16(data)))
 +			/* Pull data (len bytes); length is big-endian */
 +			if (!skb_pull(skb, get_unaligned_be16(&hdr[1])))
  				goto badframe;
  			break;
 +		}
  		default:
  			kfree_skb(skb);
  			return 0;

Attachment: signature.asc
Description: PGP signature