rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

Bluetooth: Add sockaddr length checks before accessing sa_family in bind and connect handlers

Browse Source 
Verify that the caller-provided sockaddr structure is large enough to
contain the sa_family field, before accessing it in bind() and connect()
handlers of the Bluetooth sockets. Since neither syscall enforces a minimum
size of the corresponding memory region, very short sockaddrs (zero or one
byte long) result in operating on uninitialized memory while referencing
sa_family.

Change-Id: I3c3bf3c9fa16abfb65f41e55c89c1ffcce2f58e7
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Mateusz Jurczyk
2019-08-08 12:09:30 +02:00
committed by Francescodario Cuzzocrea
parent 830bd1187c
commit 09c8028e8e
4 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/linux/stddef.h
+9
View File
@@ -21,4 +21,13 @@ enum {
#endif
#endif /* __KERNEL__ */
/**
* offsetofend(TYPE, MEMBER)
*
* @TYPE: The type of the structure
* @MEMBER: The member within the structure to get the end offset of
*/
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof(((TYPE *)0)->MEMBER))
#endif
net/bluetooth/l2cap_sock.c
+3 -2
View File
@@ -132,7 +132,8 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
BT_DBG("sk %p", sk);
if (!addr || addr->sa_family != AF_BLUETOOTH)
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
memset(&la, 0, sizeof(la));
@@ -200,7 +201,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
BT_DBG("sk %p type %d mode %d state %d", sk, sk->sk_type,
l2cap_pi(sk)->mode, sk->sk_state);
if (!addr || alen < sizeof(addr->sa_family) ||
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
net/bluetooth/rfcomm/sock.c
+2 -1
View File
@@ -350,7 +350,8 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
struct sock *sk = sock->sk;
int len, err = 0;
if (!addr || addr->sa_family != AF_BLUETOOTH)
if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
memset(&sa, 0, sizeof(sa));
net/bluetooth/sco.c
+2 -1
View File
@@ -497,7 +497,8 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
BT_DBG("sk %p %s", sk, batostr(&sa.sco_bdaddr));
if (!addr || addr->sa_family != AF_BLUETOOTH)
if (!addr || alen < sizeof(struct sockaddr_sco) ||
addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
if (alen < sizeof(struct sockaddr_sco))