mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Bluetooth: hci_sock: Fix not validating setsockopt user input 

Check user input length before copying data.

Fixes: 09572fca72 ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2024-04-05 16:46:50 -04:00
parent 9e8742cdfc
commit b2186061d6
1 changed files with 8 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
net/bluetooth/hci_sock.c
View File

@ -1946,10 +1946,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
switch (optname) { switch (optname) {
case HCI_DATA_DIR: case HCI_DATA_DIR:
if (copy_from_sockptr(&opt, optval, sizeof(opt))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
err = -EFAULT; if (err)
break; break;
}
if (opt) if (opt)
hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@ -1958,10 +1957,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
break; break;
case HCI_TIME_STAMP: case HCI_TIME_STAMP:
if (copy_from_sockptr(&opt, optval, sizeof(opt))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
err = -EFAULT; if (err)
break; break;
}
if (opt) if (opt)
hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@ -1979,11 +1977,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
uf.event_mask[1] = *((u32 *) f->event_mask + 1); uf.event_mask[1] = *((u32 *) f->event_mask + 1);
} }
len = min_t(unsigned int, len, sizeof(uf)); err = bt_copy_from_sockptr(&uf, sizeof(uf), optval, len);
if (copy_from_sockptr(&uf, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (!capable(CAP_NET_RAW)) { if (!capable(CAP_NET_RAW)) {
uf.type_mask &= hci_sec_filter.type_mask; uf.type_mask &= hci_sec_filter.type_mask;
@ -2042,10 +2038,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
goto done; goto done;
} }
if (copy_from_sockptr(&opt, optval, sizeof(opt))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
err = -EFAULT; if (err)
break; break;
}
hci_pi(sk)->mtu = opt; hci_pi(sk)->mtu = opt;
break; break;