mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 12:57:53 +00:00
Code Issues Releases Wiki Activity

Bluetooth: L2CAP: Fix not validating setsockopt user input

Browse source 
[ Upstream commit 4f3951242a ]

Check user input length before copying data.

Fixes: 33575df7be ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c")
Fixes: 3ee7b7cd83 ("Bluetooth: Add BT_MODE socket option")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Luiz Augusto von Dentz 2024-04-05 15:50:47 -04:00 committed by Greg Kroah-Hartman
parent 7bc65d23ba
commit 9d42f37339
1 changed files with 20 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
net/bluetooth/l2cap_sock.c
View file

@ -745,7 +745,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_chan *chan = l2cap_pi(sk)->chan;
struct l2cap_options opts; struct l2cap_options opts;
int len, err = 0; int err = 0;
u32 opt; u32 opt;
BT_DBG("sk %p", sk); BT_DBG("sk %p", sk);
@ -772,11 +772,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
opts.max_tx = chan->max_tx; opts.max_tx = chan->max_tx;
opts.txwin_size = chan->tx_win; opts.txwin_size = chan->tx_win;
len = min_t(unsigned int, sizeof(opts), optlen); err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
if (copy_from_sockptr(&opts, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
err = -EINVAL; err = -EINVAL;
@ -819,10 +817,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
break; break;
case L2CAP_LM: case L2CAP_LM:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt & L2CAP_LM_FIPS) { if (opt & L2CAP_LM_FIPS) {
err = -EINVAL; err = -EINVAL;
@ -903,7 +900,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
struct bt_security sec; struct bt_security sec;
struct bt_power pwr; struct bt_power pwr;
struct l2cap_conn *conn; struct l2cap_conn *conn;
int len, err = 0; int err = 0;
u32 opt; u32 opt;
u16 mtu; u16 mtu;
u8 mode; u8 mode;
@ -929,11 +926,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
sec.level = BT_SECURITY_LOW; sec.level = BT_SECURITY_LOW;
len = min_t(unsigned int, sizeof(sec), optlen); err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
if (copy_from_sockptr(&sec, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (sec.level < BT_SECURITY_LOW || if (sec.level < BT_SECURITY_LOW ||
sec.level > BT_SECURITY_FIPS) { sec.level > BT_SECURITY_FIPS) {
@ -978,10 +973,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt) { if (opt) {
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@ -993,10 +987,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
case BT_FLUSHABLE: case BT_FLUSHABLE:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt > BT_FLUSHABLE_ON) { if (opt > BT_FLUSHABLE_ON) {
err = -EINVAL; err = -EINVAL;
@ -1028,11 +1021,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
len = min_t(unsigned int, sizeof(pwr), optlen); err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
if (copy_from_sockptr(&pwr, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (pwr.force_active) if (pwr.force_active)
set_bit(FLAG_FORCE_ACTIVE, &chan->flags); set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@ -1041,10 +1032,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
case BT_CHANNEL_POLICY: case BT_CHANNEL_POLICY:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
err = -EINVAL; err = -EINVAL;
@ -1089,10 +1079,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
sk->sk_state == BT_CONNECTED) sk->sk_state == BT_CONNECTED)
@ -1120,10 +1109,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&mode, optval, sizeof(u8))) { err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
BT_DBG("mode %u", mode); BT_DBG("mode %u", mode);