Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp9087467pxu; Mon, 28 Dec 2020 06:19:39 -0800 (PST) X-Google-Smtp-Source: ABdhPJwoODTACAQrWrVf/jV1nORgPL5zqW9OP8XYFvQ2nP2/rG0yol+p46ESCrWiG7+I2cVG1E5a X-Received: by 2002:aa7:cfd7:: with SMTP id r23mr42080503edy.298.1609165179790; Mon, 28 Dec 2020 06:19:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1609165179; cv=none; d=google.com; s=arc-20160816; b=VtP/inEhZAwWy6OcFVmd8+AtDBQ5h6E1+/M43P76WkQVN+Y9AahIGY5rTfLA5O3iFM t09SwzpoDeRUTBHgkX+k1Rsfh3UQxihjVA1juv3JGk6ksIDY16Kocm2nIGpTSi2C7pDF NWK7Y4toy1UKDdYvhh80xi2/zsP3/2/mBobymiHtupY64ufZhzoa0Q+nyTul4yshinay q32yp9NJ7NrB0StErt5xbLPeIMD81bT99f6QEzipaB9VyI0uFGEMvaoFXU8AH0n3lHh1 E900ac4zGVRFC0anq5EqeBsz8KOW8YDmRkYDqHP/lpR/FurXrhR8wcU2M0hlsSPb9I6I 7wLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=xejaTzaHp/aTrt02FcuTPnPBhrPgKFNLpYZCJ2qE9yE=; b=joLqo/+q5IC3426Xc4Bs4XysYonihfGq0GleT6xuZ/KI2GwG/L/ihX7tb/Or3iTFxe tNbjS8bM47I99dJX4eNa7YFaCYqYHHC50SBMkpOs6xsvJWfY+2u4SuSMCk2NjN5y+l9/ VtjEj6SAc3wjislPnedU6hxTnUfXdVL7tQP5M75N/DMoX2fab0XXrf9sqwsAKjmMLKEr W9XH5UfZ+em8azYc7Ga9eKhCGvyJSwsd2tgpizPVwQjXBD+x/mf9cXvPKtkLGDaYn/8p DpgWmFQoQs8oIXgW71n+MatC9wr5hWTe/CDzQs+rCYuBdGYPAPKHfTpeOaQ4wbteIZr+ JBcw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="VuDD/exp"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y11si18481140ejp.753.2020.12.28.06.19.16; Mon, 28 Dec 2020 06:19:39 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="VuDD/exp"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2441414AbgL1ORP (ORCPT + 99 others); Mon, 28 Dec 2020 09:17:15 -0500 Received: from mail.kernel.org ([198.145.29.99]:50722 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2438885AbgL1OPs (ORCPT ); Mon, 28 Dec 2020 09:15:48 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 191142063A; Mon, 28 Dec 2020 14:15:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1609164907; bh=8Ms/lSEYHBmgeXBQgEazfZHhVpyEwc9ERK9/wEkTuF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VuDD/exp5j9gb4Okf5JX7VeUH0cQwAY7wPo4aj2F5x9EiV7kGBEv2fRkN+OPYf5El NlBe5GBGBJcAD4UKP1B1gzuSlazuy5qMbyc6UscKd+nXFHNLXKhBkUk5LdN49PxK06 9sJpudWOeGPIPaVTNkQC92M7b453KkUeS4qbV944= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Luiz Augusto Von Dentz , Marcel Holtmann , Johan Hedberg , Sasha Levin Subject: [PATCH 5.10 340/717] Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option Date: Mon, 28 Dec 2020 13:45:38 +0100 Message-Id: <20201228125037.311778744@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201228125020.963311703@linuxfoundation.org> References: <20201228125020.963311703@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Wei Yongjun [ Upstream commit f6b8c6b5543983e9de29dc14716bfa4eb3f157c4 ] This commit add the invalid check for connected socket, without it will causes the following crash due to sco_pi(sk)->conn being NULL: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c RSP: 0018:ffff88801bb17d88 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83a4ecdf RDX: 000000000000000a RSI: ffffc90002fce000 RDI: 0000000000000050 RBP: 1ffff11003762fb4 R08: 0000000000000001 R09: ffff88810e1008c0 R10: ffffffffbd695dcf R11: fffffbfff7ad2bb9 R12: 0000000000000000 R13: ffff888018ff1000 R14: dffffc0000000000 R15: 000000000000000d FS: 00007fb4f76c1700(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555e3b7a938 CR3: 00000001117be001 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? sco_skb_put_cmsg+0x80/0x80 ? sco_skb_put_cmsg+0x80/0x80 __sys_getsockopt+0x12a/0x220 ? __ia32_sys_setsockopt+0x150/0x150 ? syscall_enter_from_user_mode+0x18/0x50 ? rcu_read_lock_bh_held+0xb0/0xb0 __x64_sys_getsockopt+0xba/0x150 ? syscall_enter_from_user_mode+0x1d/0x50 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 0fc1a726f897 ("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Reviewed-by: Luiz Augusto Von Dentz Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg Signed-off-by: Sasha Levin --- net/bluetooth/sco.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 79ffcdef0b7ad..22a110f37abc6 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -1003,6 +1003,11 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, case BT_SNDMTU: case BT_RCVMTU: + if (sk->sk_state != BT_CONNECTED) { + err = -ENOTCONN; + break; + } + if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval)) err = -EFAULT; break; -- 2.27.0