Commit b2186061 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: hci_sock: Fix not validating setsockopt user input 



Check user input length before copying data.

Fixes: 09572fca ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 9e8742cd

net/bluetooth/hci_sock.c

+8 −13
Original line number Diff line number Diff line
@@ -1946,10 +1946,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 


	switch (optname) {

	case HCI_DATA_DIR:

		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		if (opt)

			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@@ -1958,10 +1957,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 
		break;



	case HCI_TIME_STAMP:

		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		if (opt)

			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@@ -1979,11 +1977,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);

		}



		len = min_t(unsigned int, len, sizeof(uf));

		if (copy_from_sockptr(&uf, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&uf, sizeof(uf), optval, len);

		if (err)

			break;

		}



		if (!capable(CAP_NET_RAW)) {

			uf.type_mask &= hci_sec_filter.type_mask;
@@ -2042,10 +2038,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 
			goto done;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		hci_pi(sk)->mtu = opt;

		break;