Bluetooth: Improve setsockopt() handling of malformed user input
The bt_copy_from_sockptr() return value is being misinterpreted by most users: a non-zero result is mistakenly assumed to represent an error code, but actually indicates the number of bytes that could not be copied. Remove bt_copy_from_sockptr() and adapt callers to use copy_safe_from_sockptr(). For sco_sock_setsockopt() (case BT_CODEC) use copy_struct_from_sockptr() to scrub parts of uninitialized buffer. Opportunistically, rename `len` to `optlen` in hci_sock_setsockopt_old() and hci_sock_setsockopt(). Fixes: 51eda36d ("Bluetooth: SCO: Fix not validating setsockopt user input") Fixes: a97de7bf ("Bluetooth: RFCOMM: Fix not validating setsockopt user input") Fixes: 4f395124 ("Bluetooth: L2CAP: Fix not validating setsockopt user input") Fixes: 9e8742cd ("Bluetooth: ISO: Fix not validating setsockopt user input") Fixes: b2186061 ("Bluetooth: hci_sock: Fix not validating setsockopt user input") Reviewed-by:Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Reviewed-by:
David Wei <dw@davidwei.uk> Signed-off-by:
Michal Luczaj <mhal@rbox.co> Signed-off-by:
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Loading
Please sign in to comment