Commit e31bf312 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Zhao Mengmeng
Browse files

Bluetooth: L2CAP: Fix not validating setsockopt user input 

mainline inclusion
from mainline-v6.9-rc4
commit 4f3951242ace5efc7131932e2e01e6ac6baed846
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE
CVE: CVE-2024-35965

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f3951242ace5efc7131932e2e01e6ac6baed846



--------------------------------

Check user input length before copying data.

Fixes: 33575df7 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c")
Fixes: 3ee7b7cd ("Bluetooth: Add BT_MODE socket option")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarZhao Mengmeng <zhaomengmeng@kylinos.cn>
parent f3f94073

net/bluetooth/l2cap_sock.c

+20 −32
Original line number Diff line number Diff line
@@ -727,7 +727,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 
	struct sock *sk = sock->sk;

	struct l2cap_chan *chan = l2cap_pi(sk)->chan;

	struct l2cap_options opts;

	int len, err = 0;

	int err = 0;

	u32 opt;



	BT_DBG("sk %p", sk);
@@ -754,11 +754,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 
		opts.max_tx   = chan->max_tx;

		opts.txwin_size = chan->tx_win;



		len = min_t(unsigned int, sizeof(opts), optlen);

		if (copy_from_sockptr(&opts, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);

		if (err)

			break;

		}



		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {

			err = -EINVAL;
@@ -801,10 +799,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 
		break;



	case L2CAP_LM:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt & L2CAP_LM_FIPS) {

			err = -EINVAL;
@@ -885,7 +882,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
	struct bt_security sec;

	struct bt_power pwr;

	struct l2cap_conn *conn;

	int len, err = 0;

	int err = 0;

	u32 opt;

	u16 mtu;

	u8 mode;
@@ -911,11 +908,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 


		sec.level = BT_SECURITY_LOW;



		len = min_t(unsigned int, sizeof(sec), optlen);

		if (copy_from_sockptr(&sec, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);

		if (err)

			break;

		}



		if (sec.level < BT_SECURITY_LOW ||

		    sec.level > BT_SECURITY_FIPS) {
@@ -960,10 +955,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt) {

			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -975,10 +969,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_FLUSHABLE:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		if (opt > BT_FLUSHABLE_ON) {

			err = -EINVAL;
@@ -1010,11 +1003,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 


		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;



		len = min_t(unsigned int, sizeof(pwr), optlen);

		if (copy_from_sockptr(&pwr, optval, len)) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);

		if (err)

			break;

		}



		if (pwr.force_active)

			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@@ -1023,10 +1014,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case BT_CHANNEL_POLICY:

		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);

		if (err)

			break;

		}



		err = -EOPNOTSUPP;

		break;
@@ -1055,10 +1045,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);

		if (err)

			break;

		}



		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&

		    sk->sk_state == BT_CONNECTED)
@@ -1086,10 +1075,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 
			break;

		}



		if (copy_from_sockptr(&mode, optval, sizeof(u8))) {

			err = -EFAULT;

		err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);

		if (err)

			break;

		}



		BT_DBG("mode %u", mode);