Unverified Commit d6c23dd1 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9068 Bluetooth: RFCOMM: Fix not validating setsockopt user input 

Merge Pull Request from: @ci-robot 
 
PR sync from: Jinjiang Tu <tujinjiang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BXN64AHYNWW3QYBZEVGWF4BGPL3CDXE5/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9QRFS 
 
Link:https://gitee.com/openeuler/kernel/pulls/9068

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents b85d7d41 7c6d0edd

net/bluetooth/rfcomm/sock.c

+5 −9
Original line number Diff line number Diff line
@@ -631,7 +631,7 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 


	switch (optname) {

	case RFCOMM_LM:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

		if (bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen)) {

			err = -EFAULT;

			break;

		}
@@ -666,7 +666,6 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 
	struct sock *sk = sock->sk;

	struct bt_security sec;

	int err = 0;

	size_t len;

	u32 opt;



	BT_DBG("sk %p", sk);
@@ -688,11 +687,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 


		sec.level = BT_SECURITY_LOW;



		len = min_t(unsigned int, sizeof(sec), optlen);

		if (copy_from_sockptr(&sec, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);

		if (err)

			break;

		}



		if (sec.level > BT_SECURITY_HIGH) {

			err = -EINVAL;
@@ -708,10 +705,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt)

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);