Commit a01cccb3 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Yongqiang Liu
Browse files

Bluetooth: ISO: Fix not validating setsockopt user input 

mainline inclusion
from mainline-v6.9-rc4
commit 9e8742cdfc4b0e65266bb4a901a19462bda9285e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPG
CVE: CVE-2024-35964

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9e8742cdfc4b0e65266bb4a901a19462bda9285e



--------------------------------

Check user input length before copying data.

Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type")
Fixes: 0731c5ab ("Bluetooth: ISO: Add support for BT_PKT_STATUS")
Fixes: f764a6c2 ("Bluetooth: ISO: Add broadcast support")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent cc0fb551

net/bluetooth/iso.c

+12 −24
Original line number Diff line number Diff line
@@ -1349,7 +1349,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			       sockptr_t optval, unsigned int optlen)

{

	struct sock *sk = sock->sk;

	int len, err = 0;

	int err = 0;

	struct bt_iso_qos qos = default_qos;

	u32 opt;
@@ -1364,10 +1364,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1376,10 +1375,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_PKT_STATUS:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1394,17 +1392,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		len = min_t(unsigned int, sizeof(qos), optlen);



		if (copy_from_sockptr(&qos, optval, len)) {

			err = -EFAULT;

			break;

		}



		if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {

			err = -EINVAL;

		err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);

		if (err)

			break;

		}



		iso_pi(sk)->qos = qos;

		iso_pi(sk)->qos_user_set = true;
@@ -1419,18 +1409,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, 
		}



		if (optlen > sizeof(iso_pi(sk)->base)) {

			err = -EOVERFLOW;

			err = -EINVAL;

			break;

		}



		len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);



		if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,

					   optlen);

		if (err)

			break;

		}



		iso_pi(sk)->base_len = len;

		iso_pi(sk)->base_len = optlen;



		break;