Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 0878b6667f28772aa7d6b735abff53efc7bf6d91

Authored by Marcel Holtmann
1 parent dc87c3985e
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[Bluetooth] Fix L2CAP and HCI setsockopt() information leaks 

The L2CAP and HCI setsockopt() implementations have a small information
leak that makes it possible to leak kernel stack memory to userspace.

If the optlen parameter is 0, no data will be copied by copy_from_user(),
but the uninitialized stack buffer will be read and stored later. A call
to getsockopt() can now retrieve the leaked information.

To fix this problem the stack buffer given to copy_from_user() must be
initialized with the current settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Showing 2 changed files with 15 additions and 0 deletions Side-by-side Diff

net/bluetooth/hci_sock.c
Diff comments   View file @ 0878b66
... ... @@ -499,6 +499,15 @@
499 499 break;
500 500  
501 501 case HCI_FILTER:
  502 + {
  503 + struct hci_filter *f = &hci_pi(sk)->filter;
  504 +
  505 + uf.type_mask = f->type_mask;
  506 + uf.opcode = f->opcode;
  507 + uf.event_mask[0] = *((u32 *) f->event_mask + 0);
  508 + uf.event_mask[1] = *((u32 *) f->event_mask + 1);
  509 + }
  510 +
502 511 len = min_t(unsigned int, len, sizeof(uf));
503 512 if (copy_from_user(&uf, optval, len)) {
504 513 err = -EFAULT;
net/bluetooth/l2cap.c
Diff comments   View file @ 0878b66
... ... @@ -954,11 +954,17 @@
954 954  
955 955 switch (optname) {
956 956 case L2CAP_OPTIONS:
  957 + opts.imtu = l2cap_pi(sk)->imtu;
  958 + opts.omtu = l2cap_pi(sk)->omtu;
  959 + opts.flush_to = l2cap_pi(sk)->flush_to;
  960 + opts.mode = 0x00;
  961 +
957 962 len = min_t(unsigned int, sizeof(opts), optlen);
958 963 if (copy_from_user((char *) &opts, optval, len)) {
959 964 err = -EFAULT;
960 965 break;
961 966 }
  967 +
962 968 l2cap_pi(sk)->imtu = opts.imtu;
963 969 l2cap_pi(sk)->omtu = opts.omtu;
964 970 break;