nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

Bluetooth: ISO: Fix not validating setsockopt user input

Browse source 
Check user input length before copying data.

Fixes: ccf74f2390 ("Bluetooth: Add BTPROTO_ISO socket type")
Fixes: 0731c5ab4d ("Bluetooth: ISO: Add support for BT_PKT_STATUS")
Fixes: f764a6c2c1 ("Bluetooth: ISO: Add broadcast support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2024-04-05 15:56:50 -04:00
parent 4f3951242a
commit 9e8742cdfc
1 changed files with 12 additions and 24 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

36
net/bluetooth/iso.c
View file

@ -1500,7 +1500,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
sockptr_t optval, unsigned int optlen) sockptr_t optval, unsigned int optlen)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
int len, err = 0; int err = 0;
struct bt_iso_qos qos = default_qos; struct bt_iso_qos qos = default_qos;
u32 opt; u32 opt;
@ -1515,10 +1515,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt) if (opt)
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@ -1527,10 +1526,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
case BT_PKT_STATUS: case BT_PKT_STATUS:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt) if (opt)
set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@ -1545,17 +1543,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
len = min_t(unsigned int, sizeof(qos), optlen); err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);
if (err)
if (copy_from_sockptr(&qos, optval, len)) {
err = -EFAULT;
break; break;
}
if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {
err = -EINVAL;
break;
}
iso_pi(sk)->qos = qos; iso_pi(sk)->qos = qos;
iso_pi(sk)->qos_user_set = true; iso_pi(sk)->qos_user_set = true;
@ -1570,18 +1560,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
} }
if (optlen > sizeof(iso_pi(sk)->base)) { if (optlen > sizeof(iso_pi(sk)->base)) {
err = -EOVERFLOW; err = -EINVAL;
break; break;
} }
len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen); err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,
optlen);
if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
iso_pi(sk)->base_len = len; iso_pi(sk)->base_len = optlen;
break; break;