Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0fba2558 authored by Mat Martineau's avatar Mat Martineau Committed by Gustavo Padovan
Browse files

Bluetooth: Validate PSM values in calls to connect() and bind() 



Valid L2CAP PSMs are odd numbers, and the least significant bit of the
most significant byte must be 0.

Signed-off-by: default avatarMat Martineau <mathewm@codeaurora.org>
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
parent 08601469

net/bluetooth/l2cap.c

+21 −4
Original line number Diff line number Diff line
@@ -1008,11 +1008,21 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) 
		goto done;

	}



	if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&

				!capable(CAP_NET_BIND_SERVICE)) {

	if (la.l2_psm) {

		__u16 psm = __le16_to_cpu(la.l2_psm);



		/* PSM must be odd and lsb of upper byte must be 0 */

		if ((psm & 0x0101) != 0x0001) {

			err = -EINVAL;

			goto done;

		}



		/* Restrict usage of well-known PSMs */

		if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {

			err = -EACCES;

			goto done;

		}

	}



	write_lock_bh(&l2cap_sk_list.lock);
@@ -1190,6 +1200,13 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al 
		goto done;

	}



	/* PSM must be odd and lsb of upper byte must be 0 */

	if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&

		sk->sk_type != SOCK_RAW) {

		err = -EINVAL;

		goto done;

	}



	/* Set destination address and psm */

	bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);

	l2cap_pi(sk)->psm = la.l2_psm;