Bluetooth: Properly check L2CAP config option output buffer length
Ben Seri [Wed, 13 Sep 2017 08:34:32 +0000 (13:34 +0530)]
Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Bug 1989825

Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558952
GVS: Gerrit_Virtual_Submit

net/bluetooth/l2cap_core.c

index c11a28b..10d4bee 100644 (file)
@@ -52,7 +52,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
                                       u8 code, u8 ident, u16 dlen, void *data);
 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
                           void *data);
-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
 
 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
@@ -1283,7 +1283,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                        set_bit(CONF_REQ_SENT, &chan->conf_state);
                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                      l2cap_build_conf_req(chan, buf), buf);
+                                      l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
                        chan->num_conf_req++;
                }
 
@@ -2941,12 +2941,15 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
        return len;
 }
 
-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
 {
        struct l2cap_conf_opt *opt = *ptr;
 
        BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
 
+       if (size < L2CAP_CONF_OPT_SIZE + len)
+               return;
+
        opt->type = type;
        opt->len  = len;
 
@@ -2971,7 +2974,7 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
        *ptr += L2CAP_CONF_OPT_SIZE + len;
 }
 
-static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
+static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
 {
        struct l2cap_conf_efs efs;
 
@@ -2999,7 +3002,7 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
        }
 
        l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
-                          (unsigned long) &efs);
+                          (unsigned long) &efs, size);
 }
 
 static void l2cap_ack_timeout(struct work_struct *work)
@@ -3143,11 +3146,12 @@ static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
        chan->ack_win = chan->tx_win;
 }
 
-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
 {
        struct l2cap_conf_req *req = data;
        struct l2cap_conf_rfc rfc = { .mode = chan->mode };
        void *ptr = req->data;
+       void *endptr = data + data_size;
        u16 size;
 
        BT_DBG("chan %p", chan);
@@ -3172,7 +3176,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
 
 done:
        if (chan->imtu != L2CAP_DEFAULT_MTU)
-               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
 
        switch (chan->mode) {
        case L2CAP_MODE_BASIC:
@@ -3188,7 +3192,7 @@ done:
                rfc.max_pdu_size    = 0;
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                  (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);
                break;
 
        case L2CAP_MODE_ERTM:
@@ -3208,21 +3212,21 @@ done:
                                       L2CAP_DEFAULT_TX_WINDOW);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                  (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);
 
                if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
-                       l2cap_add_opt_efs(&ptr, chan);
+                       l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
 
                if (test_bit(FLAG_EXT_CTRL, &chan->flags))
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
-                                          chan->tx_win);
+                                          chan->tx_win, endptr - ptr);
 
                if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
                        if (chan->fcs == L2CAP_FCS_NONE ||
                            test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
                                chan->fcs = L2CAP_FCS_NONE;
                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
-                                                  chan->fcs);
+                                                  chan->fcs, endptr - ptr);
                        }
                break;
 
@@ -3240,17 +3244,17 @@ done:
                rfc.max_pdu_size = cpu_to_le16(size);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                  (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);
 
                if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
-                       l2cap_add_opt_efs(&ptr, chan);
+                       l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
 
                if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
                        if (chan->fcs == L2CAP_FCS_NONE ||
                            test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
                                chan->fcs = L2CAP_FCS_NONE;
                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
-                                                  chan->fcs);
+                                                  chan->fcs, endptr - ptr);
                        }
                break;
        }
@@ -3261,10 +3265,11 @@ done:
        return ptr - data;
 }
 
-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
 {
        struct l2cap_conf_rsp *rsp = data;
        void *ptr = rsp->data;
+       void *endptr = data + data_size;
        void *req = chan->conf_req;
        int len = chan->conf_len;
        int type, hint, olen;
@@ -3366,7 +3371,7 @@ done:
                        return -ECONNREFUSED;
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                  (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);
        }
 
        if (result == L2CAP_CONF_SUCCESS) {
@@ -3379,7 +3384,7 @@ done:
                        chan->omtu = mtu;
                        set_bit(CONF_MTU_DONE, &chan->conf_state);
                }
-               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
 
                if (remote_efs) {
                        if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
@@ -3393,7 +3398,7 @@ done:
 
                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
                                                   sizeof(efs),
-                                                  (unsigned long) &efs);
+                                                  (unsigned long) &efs, endptr - ptr);
                        } else {
                                /* Send PENDING Conf Rsp */
                                result = L2CAP_CONF_PENDING;
@@ -3426,7 +3431,7 @@ done:
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                          sizeof(rfc), (unsigned long) &rfc);
+                                          sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
 
                        if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
                                chan->remote_id = efs.id;
@@ -3440,7 +3445,7 @@ done:
                                        le32_to_cpu(efs.sdu_itime);
                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
                                                   sizeof(efs),
-                                                  (unsigned long) &efs);
+                                                  (unsigned long) &efs, endptr - ptr);
                        }
                        break;
 
@@ -3454,7 +3459,7 @@ done:
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                          (unsigned long) &rfc);
+                                          (unsigned long) &rfc, endptr - ptr);
 
                        break;
 
@@ -3476,10 +3481,11 @@ done:
 }
 
 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
-                               void *data, u16 *result)
+                               void *data, size_t size, u16 *result)
 {
        struct l2cap_conf_req *req = data;
        void *ptr = req->data;
+       void *endptr = data + size;
        int type, olen;
        unsigned long val;
        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
@@ -3497,13 +3503,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
                                chan->imtu = L2CAP_DEFAULT_MIN_MTU;
                        } else
                                chan->imtu = val;
-                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
                        break;
 
                case L2CAP_CONF_FLUSH_TO:
                        chan->flush_to = val;
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
-                                          2, chan->flush_to);
+                                          2, chan->flush_to, endptr - ptr);
                        break;
 
                case L2CAP_CONF_RFC:
@@ -3517,13 +3523,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
                        chan->fcs = 0;
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                          sizeof(rfc), (unsigned long) &rfc);
+                                          sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
                        break;
 
                case L2CAP_CONF_EWS:
                        chan->ack_win = min_t(u16, val, chan->ack_win);
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
-                                          chan->tx_win);
+                                          chan->tx_win, endptr - ptr);
                        break;
 
                case L2CAP_CONF_EFS:
@@ -3536,7 +3542,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
                                return -ECONNREFUSED;
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
-                                          (unsigned long) &efs);
+                                          (unsigned long) &efs, endptr - ptr);
                        break;
 
                case L2CAP_CONF_FCS:
@@ -3624,7 +3630,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
                return;
 
        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                      l2cap_build_conf_req(chan, buf), buf);
+                      l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
        chan->num_conf_req++;
 }
 
@@ -3828,7 +3834,7 @@ sendresp:
                u8 buf[128];
                set_bit(CONF_REQ_SENT, &chan->conf_state);
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                              l2cap_build_conf_req(chan, buf), buf);
+                              l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
                chan->num_conf_req++;
        }
 
@@ -3908,7 +3914,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
                        break;
 
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                              l2cap_build_conf_req(chan, req), req);
+                              l2cap_build_conf_req(chan, req, sizeof(req)), req);
                chan->num_conf_req++;
                break;
 
@@ -4012,7 +4018,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
        }
 
        /* Complete config. */
-       len = l2cap_parse_conf_req(chan, rsp);
+       len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
        if (len < 0) {
                l2cap_send_disconn_req(chan, ECONNRESET);
                goto unlock;
@@ -4046,7 +4052,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
        if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
                u8 buf[64];
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                              l2cap_build_conf_req(chan, buf), buf);
+                              l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
                chan->num_conf_req++;
        }
 
@@ -4106,7 +4112,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        char buf[64];
 
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
-                                                  buf, &result);
+                                                  buf, sizeof(buf), &result);
                        if (len < 0) {
                                l2cap_send_disconn_req(chan, ECONNRESET);
                                goto done;
@@ -4136,7 +4142,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        /* throw out any old stored conf requests */
                        result = L2CAP_CONF_SUCCESS;
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
-                                                  req, &result);
+                                                  req, sizeof(req), &result);
                        if (len < 0) {
                                l2cap_send_disconn_req(chan, ECONNRESET);
                                goto done;
@@ -4718,7 +4724,7 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result,
                        set_bit(CONF_REQ_SENT, &chan->conf_state);
                        l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
                                       L2CAP_CONF_REQ,
-                                      l2cap_build_conf_req(chan, buf), buf);
+                                      l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
                        chan->num_conf_req++;
                }
        }
@@ -6604,7 +6610,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                set_bit(CONF_REQ_SENT, &chan->conf_state);
                                l2cap_send_cmd(conn, l2cap_get_ident(conn),
                                               L2CAP_CONF_REQ,
-                                              l2cap_build_conf_req(chan, buf),
+                                              l2cap_build_conf_req(chan, buf, sizeof(buf)),
                                               buf);
                                chan->num_conf_req++;
                        }