Commit 9e8742cd authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: ISO: Fix not validating setsockopt user input 



Check user input length before copying data.

Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type")
Fixes: 0731c5ab ("Bluetooth: ISO: Add support for BT_PKT_STATUS")
Fixes: f764a6c2 ("Bluetooth: ISO: Add broadcast support")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 4f395124

net/bluetooth/iso.c

+12 −24
Original line number Diff line number Diff line
@@ -1500,7 +1500,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			       sockptr_t optval, unsigned int optlen)

{

	struct sock *sk = sock->sk;

	int len, err = 0;

	int err = 0;

	struct bt_iso_qos qos = default_qos;

	u32 opt;
@@ -1515,10 +1515,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1527,10 +1526,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_PKT_STATUS:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1545,17 +1543,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		len = min_t(unsigned int, sizeof(qos), optlen);



		if (copy_from_sockptr(&qos, optval, len)) {

			err = -EFAULT;

			break;

		}



		if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {

			err = -EINVAL;

		err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);

		if (err)

			break;

		}



		iso_pi(sk)->qos = qos;

		iso_pi(sk)->qos_user_set = true;
@@ -1570,18 +1560,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		}



		if (optlen > sizeof(iso_pi(sk)->base)) {

			err = -EOVERFLOW;

			err = -EINVAL;

			break;

		}



		len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);



		if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,

					   optlen);

		if (err)

			break;

		}



		iso_pi(sk)->base_len = len;

		iso_pi(sk)->base_len = optlen;



		break;