public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-05-14 19:53:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bluetooth: L2CAP: Fix not validating setsockopt user input

Browse source 
Check user input length before copying data.

Fixes: 33575df7be ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c")
Fixes: 3ee7b7cd83 ("Bluetooth: Add BT_MODE socket option")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2024-04-05 15:50:47 -04:00
parent a97de7bff1
commit 4f3951242a
1 changed files with 20 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
net/bluetooth/l2cap_sock.c
View file

@ -727,7 +727,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_chan *chan = l2cap_pi(sk)->chan;
struct l2cap_options opts; struct l2cap_options opts;
int len, err = 0; int err = 0;
u32 opt; u32 opt;
BT_DBG("sk %p", sk); BT_DBG("sk %p", sk);
@ -754,11 +754,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
opts.max_tx = chan->max_tx; opts.max_tx = chan->max_tx;
opts.txwin_size = chan->tx_win; opts.txwin_size = chan->tx_win;
len = min_t(unsigned int, sizeof(opts), optlen); err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
if (copy_from_sockptr(&opts, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
err = -EINVAL; err = -EINVAL;
@ -801,10 +799,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
break; break;
case L2CAP_LM: case L2CAP_LM:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt & L2CAP_LM_FIPS) { if (opt & L2CAP_LM_FIPS) {
err = -EINVAL; err = -EINVAL;
@ -885,7 +882,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
struct bt_security sec; struct bt_security sec;
struct bt_power pwr; struct bt_power pwr;
struct l2cap_conn *conn; struct l2cap_conn *conn;
int len, err = 0; int err = 0;
u32 opt; u32 opt;
u16 mtu; u16 mtu;
u8 mode; u8 mode;
@ -911,11 +908,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
sec.level = BT_SECURITY_LOW; sec.level = BT_SECURITY_LOW;
len = min_t(unsigned int, sizeof(sec), optlen); err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
if (copy_from_sockptr(&sec, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (sec.level < BT_SECURITY_LOW || if (sec.level < BT_SECURITY_LOW ||
sec.level > BT_SECURITY_FIPS) { sec.level > BT_SECURITY_FIPS) {
@ -960,10 +955,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt) { if (opt) {
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@ -975,10 +969,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
case BT_FLUSHABLE: case BT_FLUSHABLE:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt > BT_FLUSHABLE_ON) { if (opt > BT_FLUSHABLE_ON) {
err = -EINVAL; err = -EINVAL;
@ -1010,11 +1003,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
len = min_t(unsigned int, sizeof(pwr), optlen); err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
if (copy_from_sockptr(&pwr, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
if (pwr.force_active) if (pwr.force_active)
set_bit(FLAG_FORCE_ACTIVE, &chan->flags); set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@ -1023,10 +1014,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
case BT_CHANNEL_POLICY: case BT_CHANNEL_POLICY:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
break; break;
@ -1055,10 +1045,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
sk->sk_state == BT_CONNECTED) sk->sk_state == BT_CONNECTED)
@ -1086,10 +1075,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&mode, optval, sizeof(u8))) { err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
BT_DBG("mode %u", mode); BT_DBG("mode %u", mode);