Commit fe3eb406 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'for-net-2024-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

  - L2CAP: Don't double set the HCI_CONN_MGMT_CONNECTED bit
  - Fix memory leak in hci_req_sync_complete
  - hci_sync: Fix using the same interval and window for Coded PHY
  - Fix not validating setsockopt user input

* tag 'for-net-2024-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit
  Bluetooth: hci_sock: Fix not validating setsockopt user input
  Bluetooth: ISO: Fix not validating setsockopt user input
  Bluetooth: L2CAP: Fix not validating setsockopt user input
  Bluetooth: RFCOMM: Fix not validating setsockopt user input
  Bluetooth: SCO: Fix not validating setsockopt user input
  Bluetooth: Fix memory leak in hci_req_sync_complete()
  Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY
  Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset
====================

Link: https://lore.kernel.org/r/20240410191610.4156653-1-luiz.dentz@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 47d8ac01 600b0bbe

include/net/bluetooth/bluetooth.h

+9 −0
Original line number Diff line number Diff line
@@ -585,6 +585,15 @@ static inline struct sk_buff *bt_skb_sendmmsg(struct sock *sk, 
	return skb;

}



static inline int bt_copy_from_sockptr(void *dst, size_t dst_size,

				       sockptr_t src, size_t src_size)

{

	if (dst_size > src_size)

		return -EINVAL;



	return copy_from_sockptr(dst, src, dst_size);

}



int bt_to_errno(u16 code);

__u8 bt_status(int err);

net/bluetooth/hci_request.c

+3 −1
Original line number Diff line number Diff line
@@ -105,8 +105,10 @@ void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, 
	if (hdev->req_status == HCI_REQ_PEND) {

		hdev->req_result = result;

		hdev->req_status = HCI_REQ_DONE;

		if (skb)

		if (skb) {

			kfree_skb(hdev->req_skb);

			hdev->req_skb = skb_get(skb);

		}

		wake_up_interruptible(&hdev->req_wait_q);

	}

}

net/bluetooth/hci_sock.c

+8 −13
Original line number Diff line number Diff line
@@ -1946,10 +1946,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 


	switch (optname) {

	case HCI_DATA_DIR:

		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		if (opt)

			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@@ -1958,10 +1957,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 
		break;



	case HCI_TIME_STAMP:

		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		if (opt)

			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@@ -1979,11 +1977,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);

		}



		len = min_t(unsigned int, len, sizeof(uf));

		if (copy_from_sockptr(&uf, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&uf, sizeof(uf), optval, len);

		if (err)

			break;

		}



		if (!capable(CAP_NET_RAW)) {

			uf.type_mask &= hci_sec_filter.type_mask;
@@ -2042,10 +2038,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 
			goto done;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);

		if (err)

			break;

		}



		hci_pi(sk)->mtu = opt;

		break;

net/bluetooth/hci_sync.c

+3 −3
Original line number Diff line number Diff line
@@ -2814,8 +2814,8 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type, 
				if (qos->bcast.in.phy & BT_ISO_PHY_CODED) {

					cp->scanning_phys |= LE_SCAN_PHY_CODED;

					hci_le_scan_phy_params(phy, type,

							       interval,

							       window);

							       interval * 3,

							       window * 3);

					num_phy++;

					phy++;

				}
@@ -2835,7 +2835,7 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type, 


	if (scan_coded(hdev)) {

		cp->scanning_phys |= LE_SCAN_PHY_CODED;

		hci_le_scan_phy_params(phy, type, interval, window);

		hci_le_scan_phy_params(phy, type, interval * 3, window * 3);

		num_phy++;

		phy++;

	}

net/bluetooth/iso.c

+20 −26
Original line number Diff line number Diff line
@@ -1451,8 +1451,8 @@ static bool check_ucast_qos(struct bt_iso_qos *qos) 


static bool check_bcast_qos(struct bt_iso_qos *qos)

{

	if (qos->bcast.sync_factor == 0x00)

		return false;

	if (!qos->bcast.sync_factor)

		qos->bcast.sync_factor = 0x01;



	if (qos->bcast.packing > 0x01)

		return false;
@@ -1475,6 +1475,9 @@ static bool check_bcast_qos(struct bt_iso_qos *qos) 
	if (qos->bcast.skip > 0x01f3)

		return false;



	if (!qos->bcast.sync_timeout)

		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;



	if (qos->bcast.sync_timeout < 0x000a || qos->bcast.sync_timeout > 0x4000)

		return false;
@@ -1484,6 +1487,9 @@ static bool check_bcast_qos(struct bt_iso_qos *qos) 
	if (qos->bcast.mse > 0x1f)

		return false;



	if (!qos->bcast.timeout)

		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;



	if (qos->bcast.timeout < 0x000a || qos->bcast.timeout > 0x4000)

		return false;
@@ -1494,7 +1500,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			       sockptr_t optval, unsigned int optlen)

{

	struct sock *sk = sock->sk;

	int len, err = 0;

	int err = 0;

	struct bt_iso_qos qos = default_qos;

	u32 opt;
@@ -1509,10 +1515,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1521,10 +1526,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_PKT_STATUS:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1539,17 +1543,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		len = min_t(unsigned int, sizeof(qos), optlen);



		if (copy_from_sockptr(&qos, optval, len)) {

			err = -EFAULT;

			break;

		}



		if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {

			err = -EINVAL;

		err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);

		if (err)

			break;

		}



		iso_pi(sk)->qos = qos;

		iso_pi(sk)->qos_user_set = true;
@@ -1564,18 +1560,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		}



		if (optlen > sizeof(iso_pi(sk)->base)) {

			err = -EOVERFLOW;

			err = -EINVAL;

			break;

		}



		len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);



		if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,

					   optlen);

		if (err)

			break;

		}



		iso_pi(sk)->base_len = len;

		iso_pi(sk)->base_len = optlen;



		break;