[Bug 267396] le_advertizing_report() calls NG_HCI_M_PULLUP() without checking for failure

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267396

            Bug ID: 267396
           Summary: le_advertizing_report() calls NG_HCI_M_PULLUP()
                    without checking for failure
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #237685 text/plain
         mime type:

Created attachment 237685
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=237685&action=edit
cause a NULL dereference in le_advertizing_report()

le_advertizing_report() calls NG_HCI_M_PULLUP() without checking for
failure, and it also calls m_copydata() without first checking the
length:

                /* Get remote unit address */
                NG_HCI_M_PULLUP(event, sizeof(u_int8_t));
                addr_type = *mtod(event, u_int8_t *);
                m_adj(event, sizeof(u_int8_t));

                m_copydata(event, 0, sizeof(bdaddr), (caddr_t) &bdaddr);
                m_adj(event, sizeof(bdaddr));

I've attached a demo that causes a crash due to the pullup leaving
event set to NULL:

# cc ng36a.c -lnetgraph
# ./a.out
le_advertizing_report: hci0 - m_pullup(1) failed
panic: Fatal page fault at 0xffffffc00040d8f0: 0x00000000000010
panic() at panic+0x2a
page_fault_handler() at page_fault_handler+0x1d6
do_trap_supervisor() at do_trap_supervisor+0x74
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x70
--- exception 13, tval = 0x10
le_advertizing_report() at le_advertizing_report+0xcc
le_event() at le_event+0x9a
ng_hci_process_event() at ng_hci_process_event+0x206
ng_hci_drv_rcvdata() at ng_hci_drv_rcvdata+0xb8
ng_apply_item() at ng_apply_item+0x130
ng_snd_item() at ng_snd_item+0x1bc
ngd_send() at ngd_send+0xf8
sosend_generic() at sosend_generic+0x384
sosend() at sosend+0x68
kern_sendit() at kern_sendit+0x170
sendit() at sendit+0x9c
sys_sendto() at sys_sendto+0x40
syscallenter() at syscallenter+0xec
ecall_handler() at ecall_handler+0x18
do_trap_user() at do_trap_user+0xf6
cpu_exception_handler_user() at cpu_exception_handler_user+0x72

-- 
You are receiving this mail because:
You are the assignee for the bug.