shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: ISO: Fix not validating setsockopt user input

Browse Source 
commit 9e8742cdfc4b0e65266bb4a901a19462bda9285e upstream.

Check user input length before copying data.

Fixes: ccf74f2390 ("Bluetooth: Add BTPROTO_ISO socket type")
Fixes: 0731c5ab4d ("Bluetooth: ISO: Add support for BT_PKT_STATUS")
Fixes: f764a6c2c1 ("Bluetooth: ISO: Add broadcast support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[Xiangyu:  Bp to fix CVE: CVE-2024-35964 resolved minor conflicts]
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Luiz Augusto von Dentz
2024-04-05 15:56:50 -04:00
committed by Greg Kroah-Hartman
parent d1ac7e2620
commit cec736e60d
1 changed files with 10 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
net/bluetooth/iso.c
View File

@@ -1189,7 +1189,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
sockptr_t optval, unsigned int optlen) sockptr_t optval, unsigned int optlen)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
int len, err = 0; int err = 0;
struct bt_iso_qos qos; struct bt_iso_qos qos;
u32 opt; u32 opt;
@@ -1204,10 +1204,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u32))) { err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
err = -EFAULT; if (err)
break; break;
}
if (opt) if (opt)
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1222,18 +1221,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
len = min_t(unsigned int, sizeof(qos), optlen); err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);
if (len != sizeof(qos)) { if (err)
err = -EINVAL;
break; break;
}
memset(&qos, 0, sizeof(qos));
if (copy_from_sockptr(&qos, optval, len)) {
err = -EFAULT;
break;
}
if (!check_qos(&qos)) { if (!check_qos(&qos)) {
err = -EINVAL; err = -EINVAL;
@@ -1252,18 +1242,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
} }
if (optlen > sizeof(iso_pi(sk)->base)) { if (optlen > sizeof(iso_pi(sk)->base)) {
err = -EOVERFLOW; err = -EINVAL;
break; break;
} }
len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen); err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,
optlen);
if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) { if (err)
err = -EFAULT;
break; break;
}
iso_pi(sk)->base_len = len; iso_pi(sk)->base_len = optlen;
break; break;