Unverified Commit 43acbd37 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12440 CVE-2024-35964 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/4KINMOBFELEB6HODV2SH237JXGHO6T62/ 
Luiz Augusto von Dentz (1):
  Bluetooth: ISO: Fix not validating setsockopt user input


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I9QRPG 
 
Link:https://gitee.com/openeuler/kernel/pulls/12440

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 811cee84 a01cccb3

net/bluetooth/iso.c

+12 −24
Original line number Diff line number Diff line
@@ -1349,7 +1349,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			       sockptr_t optval, unsigned int optlen)

{

	struct sock *sk = sock->sk;

	int len, err = 0;

	int err = 0;

	struct bt_iso_qos qos = default_qos;

	u32 opt;
@@ -1364,10 +1364,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1376,10 +1375,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_PKT_STATUS:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1394,17 +1392,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		len = min_t(unsigned int, sizeof(qos), optlen);



		if (copy_from_sockptr(&qos, optval, len)) {

			err = -EFAULT;

			break;

		}



		if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {

			err = -EINVAL;

		err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);

		if (err)

			break;

		}



		iso_pi(sk)->qos = qos;

		iso_pi(sk)->qos_user_set = true;
@@ -1419,18 +1409,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		}



		if (optlen > sizeof(iso_pi(sk)->base)) {

			err = -EOVERFLOW;

			err = -EINVAL;

			break;

		}



		len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);



		if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,

					   optlen);

		if (err)

			break;

		}



		iso_pi(sk)->base_len = len;

		iso_pi(sk)->base_len = optlen;



		break;