diff mbox series

[SRU,F,5/5] Bluetooth: hci_sock: Fix not validating setsockopt user input

Message ID 20241028075902.114546-10-koichiro.den@canonical.com
State New
Headers show
Series CVE-2024-35963, CVE-2024-35965, CVE-2024-35966, CVE-2024-35967 | expand

Commit Message

Koichiro Den Oct. 28, 2024, 7:59 a.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

[ Upstream commit b2186061d6043d6345a97100460363e990af0d46 ]

Check user input length before copying data.

Fixes: 09572fca7223 ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(backported from commit 781f3a97a38a338bc893b6db7f9f9670bf1a9e37 linux-6.1.y)
[koichiroden: Use bt_copy_from_user instead of bt_copy_from_sockptr,
which was introduced in the preceding backport commit
"Bluetooth: SCO: Fix not validating setsockopt user input".
Also, dropped changes on BT_{SND,RCV}MTU cases due to missing commit
09572fca7223 ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")]
CVE-2024-35963
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
---
 net/bluetooth/hci_sock.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)
diff mbox series

Patch

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1d08f7b78fa0..a1a4df215fdc 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1883,10 +1883,9 @@  static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 
 	switch (optname) {
 	case HCI_DATA_DIR:
-		if (get_user(opt, (int __user *)optval)) {
-			err = -EFAULT;
+		err = bt_copy_from_user(&opt, sizeof(opt), optval, len);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@@ -1895,10 +1894,9 @@  static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 		break;
 
 	case HCI_TIME_STAMP:
-		if (get_user(opt, (int __user *)optval)) {
-			err = -EFAULT;
+		err = bt_copy_from_user(&opt, sizeof(opt), optval, len);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@@ -1916,11 +1914,9 @@  static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
 		}
 
-		len = min_t(unsigned int, len, sizeof(uf));
-		if (copy_from_user(&uf, optval, len)) {
-			err = -EFAULT;
+		err = bt_copy_from_user(&uf, sizeof(uf), optval, len);
+		if (err)
 			break;
-		}
 
 		if (!capable(CAP_NET_RAW)) {
 			uf.type_mask &= hci_sec_filter.type_mask;