patches.lists.linux.dev archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Ruihan Li <lrh2000@pku.edu.cn>,
	Marcel Holtmann <marcel@holtmann.org>,
	Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
	Dragos-Marian Panait <dragos.panait@windriver.com>
Subject: [PATCH 6.3 42/45] bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Date: Thu,  1 Jun 2023 14:21:38 +0100	[thread overview]
Message-ID: <20230601131940.626550790@linuxfoundation.org> (raw)
In-Reply-To: <20230601131938.702671708@linuxfoundation.org>

From: Ruihan Li <lrh2000@pku.edu.cn>

commit 000c2fa2c144c499c881a101819cf1936a1f7cf2 upstream.

Previously, channel open messages were always sent to monitors on the first
ioctl() call for unbound HCI sockets, even if the command and arguments
were completely invalid. This can leave an exploitable hole with the abuse
of invalid ioctl calls.

This commit hardens the ioctl processing logic by first checking if the
command is valid, and immediately returning with an ENOIOCTLCMD error code
if it is not. This ensures that ioctl calls with invalid commands are free
of side effects, and increases the difficulty of further exploitation by
forcing exploitation to find a way to pass a valid command first.

Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Co-developed-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_sock.c |   28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -987,6 +987,34 @@ static int hci_sock_ioctl(struct socket
 
 	BT_DBG("cmd %x arg %lx", cmd, arg);
 
+	/* Make sure the cmd is valid before doing anything */
+	switch (cmd) {
+	case HCIGETDEVLIST:
+	case HCIGETDEVINFO:
+	case HCIGETCONNLIST:
+	case HCIDEVUP:
+	case HCIDEVDOWN:
+	case HCIDEVRESET:
+	case HCIDEVRESTAT:
+	case HCISETSCAN:
+	case HCISETAUTH:
+	case HCISETENCRYPT:
+	case HCISETPTYPE:
+	case HCISETLINKPOL:
+	case HCISETLINKMODE:
+	case HCISETACLMTU:
+	case HCISETSCOMTU:
+	case HCIINQUIRY:
+	case HCISETRAW:
+	case HCIGETCONNINFO:
+	case HCIGETAUTHINFO:
+	case HCIBLOCKADDR:
+	case HCIUNBLOCKADDR:
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+
 	lock_sock(sk);
 
 	if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {



  parent reply	other threads:[~2023-06-01 13:26 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-01 13:20 [PATCH 6.3 00/45] 6.3.6-rc1 review Greg Kroah-Hartman
2023-06-01 13:20 ` [PATCH 6.3 01/45] firmware: arm_scmi: Fix incorrect alloc_workqueue() invocation Greg Kroah-Hartman
2023-06-01 13:20 ` [PATCH 6.3 02/45] firmware: arm_ffa: Fix usage of partition info get count flag Greg Kroah-Hartman
2023-06-01 13:20 ` [PATCH 6.3 03/45] spi: spi-geni-qcom: Select FIFO mode for chip select Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 04/45] coresight: perf: Release Coresight path when alloc trace id failed Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 05/45] ARM: dts: imx6ull-dhcor: Set and limit the mode for PMIC buck 1, 2 and 3 Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 06/45] selftests/bpf: Fix pkg-config call building sign-file Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 07/45] power: supply: rt9467: Fix passing zero to dev_err_probe Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 08/45] platform/x86/amd/pmf: Fix CnQF and auto-mode after resume Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 09/45] bpf: netdev: init the offload table earlier Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 10/45] gpiolib: fix allocation of mixed dynamic/static GPIOs Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 11/45] tls: rx: device: fix checking decryption status Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 12/45] tls: rx: strp: set the skb->len of detached / CoWed skbs Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 13/45] tls: rx: strp: fix determining record length in copy mode Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 14/45] tls: rx: strp: force mixed decrypted records into " Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 15/45] tls: rx: strp: factor out copying skb data Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 16/45] tls: rx: strp: preserve decryption status of skbs when needed Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 17/45] tls: rx: strp: dont use GFP_KERNEL in softirq context Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 18/45] net: fec: add dma_wmb to ensure correct descriptor values Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 19/45] cxl/port: Fix NULL pointer access in devm_cxl_add_port() Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 20/45] ASoC: Intel: avs: Fix module lookup Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 21/45] drm/i915: Move shared DPLL disabling into CRTC disable hook Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 22/45] drm/i915: Disable DPLLs before disconnecting the TC PHY Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 23/45] drm/i915: Fix PIPEDMC disabling for a bigjoiner configuration Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 24/45] net/mlx5e: TC, Fix using eswitch mapping in nic mode Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 25/45] Revert "net/mlx5: Expose steering dropped packets counter" Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 26/45] Revert "net/mlx5: Expose vnic diagnostic counters for eswitch managed vports" Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 27/45] net/mlx5: E-switch, Devcom, sync devcom events and devcom comp register Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 28/45] gpio-f7188x: fix chip name and pin count on Nuvoton chip Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 29/45] bpf, sockmap: Pass skb ownership through read_skb Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 30/45] bpf, sockmap: Convert schedule_work into delayed_work Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 31/45] bpf, sockmap: Reschedule is now done through backlog Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 32/45] bpf, sockmap: Improved check for empty queue Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 33/45] bpf, sockmap: Handle fin correctly Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 34/45] bpf, sockmap: TCP data stall on recv before accept Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 35/45] bpf, sockmap: Wake up polling after data copy Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 36/45] bpf, sockmap: Incorrectly handling copied_seq Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 37/45] blk-wbt: fix that wbt cant be disabled by default Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 38/45] blk-mq: fix race condition in active queue accounting Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 39/45] vfio/type1: check pfn valid before converting to struct page Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 40/45] cpufreq: amd-pstate: Remove fast_switch_possible flag from active driver Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 41/45] net: phy: mscc: enable VSC8501/2 RGMII RX clock Greg Kroah-Hartman
2023-06-01 13:21 ` Greg Kroah-Hartman [this message]
2023-06-01 13:21 ` [PATCH 6.3 43/45] cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 44/45] cpufreq: amd-pstate: Add ->fast_switch() callback Greg Kroah-Hartman
2023-06-01 13:21 ` [PATCH 6.3 45/45] netfilter: ctnetlink: Support offloaded conntrack entry deletion Greg Kroah-Hartman
2023-06-01 20:27 ` [PATCH 6.3 00/45] 6.3.6-rc1 review Shuah Khan
2023-06-01 20:27 ` Florian Fainelli
2023-06-02  6:15 ` Ron Economos
2023-06-02  7:01 ` Conor Dooley
2023-06-02  8:45 ` Jon Hunter
2023-06-02  9:02 ` Bagas Sanjaya
2023-06-02  9:44 ` Naresh Kamboju
2023-06-02 16:56 ` Justin Forbes
2023-06-02 22:36 ` Guenter Roeck
2023-06-05  9:19 ` Chris Paterson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230601131940.626550790@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=dragos.panait@windriver.com \
    --cc=lrh2000@pku.edu.cn \
    --cc=luiz.von.dentz@intel.com \
    --cc=marcel@holtmann.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).