diff options
| author | Michal Luczaj <[email protected]> | 2024-11-19 14:31:40 +0100 |
|---|---|---|
| committer | Luiz Augusto von Dentz <[email protected]> | 2024-12-11 11:54:57 -0500 |
| commit | 3e643e4efa1e87432204b62f9cfdea3b2508c830 (patch) | |
| tree | 439d381352145d854ba9632f0f93e41455527a90 /tools/testing/selftests/bpf/prog_tests/prog_array_init.c | |
| parent | 3dd002f20098b9569f8fd7f8703f364571e2e975 (diff) | |
Bluetooth: Improve setsockopt() handling of malformed user input
The bt_copy_from_sockptr() return value is being misinterpreted by most
users: a non-zero result is mistakenly assumed to represent an error code,
but actually indicates the number of bytes that could not be copied.
Remove bt_copy_from_sockptr() and adapt callers to use
copy_safe_from_sockptr().
For sco_sock_setsockopt() (case BT_CODEC) use copy_struct_from_sockptr() to
scrub parts of uninitialized buffer.
Opportunistically, rename `len` to `optlen` in hci_sock_setsockopt_old()
and hci_sock_setsockopt().
Fixes: 51eda36d33e4 ("Bluetooth: SCO: Fix not validating setsockopt user input")
Fixes: a97de7bff13b ("Bluetooth: RFCOMM: Fix not validating setsockopt user input")
Fixes: 4f3951242ace ("Bluetooth: L2CAP: Fix not validating setsockopt user input")
Fixes: 9e8742cdfc4b ("Bluetooth: ISO: Fix not validating setsockopt user input")
Fixes: b2186061d604 ("Bluetooth: hci_sock: Fix not validating setsockopt user input")
Reviewed-by: Luiz Augusto von Dentz <[email protected]>
Reviewed-by: David Wei <[email protected]>
Signed-off-by: Michal Luczaj <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/prog_array_init.c')
0 files changed, 0 insertions, 0 deletions