Skip to content

Commit fe3eb40

Browse files
author
Paolo Abeni
committed
Merge tag 'for-net-2024-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - L2CAP: Don't double set the HCI_CONN_MGMT_CONNECTED bit - Fix memory leak in hci_req_sync_complete - hci_sync: Fix using the same interval and window for Coded PHY - Fix not validating setsockopt user input * tag 'for-net-2024-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit Bluetooth: hci_sock: Fix not validating setsockopt user input Bluetooth: ISO: Fix not validating setsockopt user input Bluetooth: L2CAP: Fix not validating setsockopt user input Bluetooth: RFCOMM: Fix not validating setsockopt user input Bluetooth: SCO: Fix not validating setsockopt user input Bluetooth: Fix memory leak in hci_req_sync_complete() Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents 47d8ac0 + 600b0bb commit fe3eb40

File tree

9 files changed

+79
-99
lines changed

9 files changed

+79
-99
lines changed

‎include/net/bluetooth/bluetooth.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -585,6 +585,15 @@ static inline struct sk_buff *bt_skb_sendmmsg(struct sock *sk,
585585
return skb;
586586
}
587587

588+
static inline int bt_copy_from_sockptr(void *dst, size_t dst_size,
589+
sockptr_t src, size_t src_size)
590+
{
591+
if (dst_size > src_size)
592+
return -EINVAL;
593+
594+
return copy_from_sockptr(dst, src, dst_size);
595+
}
596+
588597
int bt_to_errno(u16 code);
589598
__u8 bt_status(int err);
590599

‎net/bluetooth/hci_request.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,10 @@ void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
105105
if (hdev->req_status == HCI_REQ_PEND) {
106106
hdev->req_result = result;
107107
hdev->req_status = HCI_REQ_DONE;
108-
if (skb)
108+
if (skb) {
109+
kfree_skb(hdev->req_skb);
109110
hdev->req_skb = skb_get(skb);
111+
}
110112
wake_up_interruptible(&hdev->req_wait_q);
111113
}
112114
}

‎net/bluetooth/hci_sock.c‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1946,10 +1946,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
19461946

19471947
switch (optname) {
19481948
case HCI_DATA_DIR:
1949-
if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
1950-
err = -EFAULT;
1949+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
1950+
if (err)
19511951
break;
1952-
}
19531952

19541953
if (opt)
19551954
hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@@ -1958,10 +1957,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
19581957
break;
19591958

19601959
case HCI_TIME_STAMP:
1961-
if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
1962-
err = -EFAULT;
1960+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
1961+
if (err)
19631962
break;
1964-
}
19651963

19661964
if (opt)
19671965
hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@@ -1979,11 +1977,9 @@ static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
19791977
uf.event_mask[1] = *((u32 *) f->event_mask + 1);
19801978
}
19811979

1982-
len = min_t(unsigned int, len, sizeof(uf));
1983-
if (copy_from_sockptr(&uf, optval, len)) {
1984-
err = -EFAULT;
1980+
err = bt_copy_from_sockptr(&uf, sizeof(uf), optval, len);
1981+
if (err)
19851982
break;
1986-
}
19871983

19881984
if (!capable(CAP_NET_RAW)) {
19891985
uf.type_mask &= hci_sec_filter.type_mask;
@@ -2042,10 +2038,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
20422038
goto done;
20432039
}
20442040

2045-
if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
2046-
err = -EFAULT;
2041+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, len);
2042+
if (err)
20472043
break;
2048-
}
20492044

20502045
hci_pi(sk)->mtu = opt;
20512046
break;

‎net/bluetooth/hci_sync.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2814,8 +2814,8 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
28142814
if (qos->bcast.in.phy & BT_ISO_PHY_CODED) {
28152815
cp->scanning_phys |= LE_SCAN_PHY_CODED;
28162816
hci_le_scan_phy_params(phy, type,
2817-
interval,
2818-
window);
2817+
interval * 3,
2818+
window * 3);
28192819
num_phy++;
28202820
phy++;
28212821
}
@@ -2835,7 +2835,7 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
28352835

28362836
if (scan_coded(hdev)) {
28372837
cp->scanning_phys |= LE_SCAN_PHY_CODED;
2838-
hci_le_scan_phy_params(phy, type, interval, window);
2838+
hci_le_scan_phy_params(phy, type, interval * 3, window * 3);
28392839
num_phy++;
28402840
phy++;
28412841
}

‎net/bluetooth/iso.c‎

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1451,8 +1451,8 @@ static bool check_ucast_qos(struct bt_iso_qos *qos)
14511451

14521452
static bool check_bcast_qos(struct bt_iso_qos *qos)
14531453
{
1454-
if (qos->bcast.sync_factor == 0x00)
1455-
return false;
1454+
if (!qos->bcast.sync_factor)
1455+
qos->bcast.sync_factor = 0x01;
14561456

14571457
if (qos->bcast.packing > 0x01)
14581458
return false;
@@ -1475,6 +1475,9 @@ static bool check_bcast_qos(struct bt_iso_qos *qos)
14751475
if (qos->bcast.skip > 0x01f3)
14761476
return false;
14771477

1478+
if (!qos->bcast.sync_timeout)
1479+
qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
1480+
14781481
if (qos->bcast.sync_timeout < 0x000a || qos->bcast.sync_timeout > 0x4000)
14791482
return false;
14801483

@@ -1484,6 +1487,9 @@ static bool check_bcast_qos(struct bt_iso_qos *qos)
14841487
if (qos->bcast.mse > 0x1f)
14851488
return false;
14861489

1490+
if (!qos->bcast.timeout)
1491+
qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
1492+
14871493
if (qos->bcast.timeout < 0x000a || qos->bcast.timeout > 0x4000)
14881494
return false;
14891495

@@ -1494,7 +1500,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
14941500
sockptr_t optval, unsigned int optlen)
14951501
{
14961502
struct sock *sk = sock->sk;
1497-
int len, err = 0;
1503+
int err = 0;
14981504
struct bt_iso_qos qos = default_qos;
14991505
u32 opt;
15001506

@@ -1509,10 +1515,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
15091515
break;
15101516
}
15111517

1512-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
1513-
err = -EFAULT;
1518+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
1519+
if (err)
15141520
break;
1515-
}
15161521

15171522
if (opt)
15181523
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1521,10 +1526,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
15211526
break;
15221527

15231528
case BT_PKT_STATUS:
1524-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
1525-
err = -EFAULT;
1529+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
1530+
if (err)
15261531
break;
1527-
}
15281532

15291533
if (opt)
15301534
set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1539,17 +1543,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
15391543
break;
15401544
}
15411545

1542-
len = min_t(unsigned int, sizeof(qos), optlen);
1543-
1544-
if (copy_from_sockptr(&qos, optval, len)) {
1545-
err = -EFAULT;
1546-
break;
1547-
}
1548-
1549-
if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {
1550-
err = -EINVAL;
1546+
err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen);
1547+
if (err)
15511548
break;
1552-
}
15531549

15541550
iso_pi(sk)->qos = qos;
15551551
iso_pi(sk)->qos_user_set = true;
@@ -1564,18 +1560,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
15641560
}
15651561

15661562
if (optlen > sizeof(iso_pi(sk)->base)) {
1567-
err = -EOVERFLOW;
1563+
err = -EINVAL;
15681564
break;
15691565
}
15701566

1571-
len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);
1572-
1573-
if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {
1574-
err = -EFAULT;
1567+
err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval,
1568+
optlen);
1569+
if (err)
15751570
break;
1576-
}
15771571

1578-
iso_pi(sk)->base_len = len;
1572+
iso_pi(sk)->base_len = optlen;
15791573

15801574
break;
15811575

‎net/bluetooth/l2cap_core.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4054,8 +4054,7 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
40544054
return -EPROTO;
40554055

40564056
hci_dev_lock(hdev);
4057-
if (hci_dev_test_flag(hdev, HCI_MGMT) &&
4058-
!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
4057+
if (hci_dev_test_flag(hdev, HCI_MGMT))
40594058
mgmt_device_connected(hdev, hcon, NULL, 0);
40604059
hci_dev_unlock(hdev);
40614060

‎net/bluetooth/l2cap_sock.c‎

Lines changed: 20 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -727,7 +727,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
727727
struct sock *sk = sock->sk;
728728
struct l2cap_chan *chan = l2cap_pi(sk)->chan;
729729
struct l2cap_options opts;
730-
int len, err = 0;
730+
int err = 0;
731731
u32 opt;
732732

733733
BT_DBG("sk %p", sk);
@@ -754,11 +754,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
754754
opts.max_tx = chan->max_tx;
755755
opts.txwin_size = chan->tx_win;
756756

757-
len = min_t(unsigned int, sizeof(opts), optlen);
758-
if (copy_from_sockptr(&opts, optval, len)) {
759-
err = -EFAULT;
757+
err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
758+
if (err)
760759
break;
761-
}
762760

763761
if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
764762
err = -EINVAL;
@@ -801,10 +799,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
801799
break;
802800

803801
case L2CAP_LM:
804-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
805-
err = -EFAULT;
802+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
803+
if (err)
806804
break;
807-
}
808805

809806
if (opt & L2CAP_LM_FIPS) {
810807
err = -EINVAL;
@@ -885,7 +882,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
885882
struct bt_security sec;
886883
struct bt_power pwr;
887884
struct l2cap_conn *conn;
888-
int len, err = 0;
885+
int err = 0;
889886
u32 opt;
890887
u16 mtu;
891888
u8 mode;
@@ -911,11 +908,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
911908

912909
sec.level = BT_SECURITY_LOW;
913910

914-
len = min_t(unsigned int, sizeof(sec), optlen);
915-
if (copy_from_sockptr(&sec, optval, len)) {
916-
err = -EFAULT;
911+
err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
912+
if (err)
917913
break;
918-
}
919914

920915
if (sec.level < BT_SECURITY_LOW ||
921916
sec.level > BT_SECURITY_FIPS) {
@@ -960,10 +955,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
960955
break;
961956
}
962957

963-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
964-
err = -EFAULT;
958+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
959+
if (err)
965960
break;
966-
}
967961

968962
if (opt) {
969963
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -975,10 +969,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
975969
break;
976970

977971
case BT_FLUSHABLE:
978-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
979-
err = -EFAULT;
972+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
973+
if (err)
980974
break;
981-
}
982975

983976
if (opt > BT_FLUSHABLE_ON) {
984977
err = -EINVAL;
@@ -1010,11 +1003,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
10101003

10111004
pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
10121005

1013-
len = min_t(unsigned int, sizeof(pwr), optlen);
1014-
if (copy_from_sockptr(&pwr, optval, len)) {
1015-
err = -EFAULT;
1006+
err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1007+
if (err)
10161008
break;
1017-
}
10181009

10191010
if (pwr.force_active)
10201011
set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@@ -1023,10 +1014,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
10231014
break;
10241015

10251016
case BT_CHANNEL_POLICY:
1026-
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
1027-
err = -EFAULT;
1017+
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
1018+
if (err)
10281019
break;
1029-
}
10301020

10311021
err = -EOPNOTSUPP;
10321022
break;
@@ -1055,10 +1045,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
10551045
break;
10561046
}
10571047

1058-
if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
1059-
err = -EFAULT;
1048+
err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1049+
if (err)
10601050
break;
1061-
}
10621051

10631052
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
10641053
sk->sk_state == BT_CONNECTED)
@@ -1086,10 +1075,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
10861075
break;
10871076
}
10881077

1089-
if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
1090-
err = -EFAULT;
1078+
err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
1079+
if (err)
10911080
break;
1092-
}
10931081

10941082
BT_DBG("mode %u", mode);
10951083

0 commit comments

Comments
 (0)