]> git.hungrycats.org Git - linux/commitdiff
Bluetooth: ISO: Fix not validating setsockopt user input
authorLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Fri, 5 Apr 2024 19:56:50 +0000 (15:56 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 22 Nov 2024 14:37:32 +0000 (15:37 +0100)
commit 9e8742cdfc4b0e65266bb4a901a19462bda9285e upstream.

Check user input length before copying data.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Fixes: 0731c5ab4d51 ("Bluetooth: ISO: Add support for BT_PKT_STATUS")
Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[Xiangyu:  Bp to fix CVE: CVE-2024-35964 resolved minor conflicts]
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/bluetooth/iso.c

index 27efca5dc7bbf787b7ef0d8d2f4e1959930888d1..ff15d5192768ab3721096886f174626444bc1daa 100644 (file)
@@ -1189,7 +1189,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
                               sockptr_t optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
-       int len, err = 0;
+       int err = 0;
        struct bt_iso_qos qos;
        u32 opt;
 
@@ -1204,10 +1204,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
                        break;
                }
 
-               if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-                       err = -EFAULT;
+               err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
+               if (err)
                        break;
-               }
 
                if (opt)
                        set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1222,18 +1221,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
                        break;
                }
 
-               len = min_t(unsigned int, sizeof(qos), optlen);
-               if (len != sizeof(qos)) {
-                       err = -EINVAL;
-                       break;
-               }
-
-               memset(&qos, 0, sizeof(qos));
-
-               if (copy_from_sockptr(&qos, optval, len)) {
-                       err = -EFAULT;
+               err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);
+               if (err)
                        break;
-               }
 
                if (!check_qos(&qos)) {
                        err = -EINVAL;
@@ -1252,18 +1242,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
                }
 
                if (optlen > sizeof(iso_pi(sk)->base)) {
-                       err = -EOVERFLOW;
+                       err = -EINVAL;
                        break;
                }
 
-               len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);
-
-               if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {
-                       err = -EFAULT;
+               err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,
+                                          optlen);
+               if (err)
                        break;
-               }
 
-               iso_pi(sk)->base_len = len;
+               iso_pi(sk)->base_len = optlen;
 
                break;