This makes it possible to bind a PA sync socket to a number of BISes
before issuing the BIG Create Sync command.
Signed-off-by: Iulia Tanasescu <[email protected]>
---
net/bluetooth/iso.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 07b80e97aead..f20238c4702f 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -813,6 +813,37 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
return 0;
}
+static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa,
+ int addr_len)
+{
+ int err = 0;
+
+ if (sk->sk_type != SOCK_SEQPACKET) {
+ err = -EINVAL;
+ goto done;
+ }
+
+ if (addr_len <= sizeof(*sa)) {
+ err = -EINVAL;
+ goto done;
+ }
+
+ iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
+
+ for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
+ if (sa->iso_bc->bc_bis[i] < 0x01 ||
+ sa->iso_bc->bc_bis[i] > 0x1f) {
+ err = -EINVAL;
+ goto done;
+ }
+
+ memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
+ iso_pi(sk)->bc_num_bis);
+
+done:
+ return err;
+}
+
static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
@@ -828,6 +859,15 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
lock_sock(sk);
+ /* Allow the user to bind a PA sync socket to a number
+ * of BISes to sync to.
+ */
+ if (sk->sk_state == BT_CONNECT2 &&
+ test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
+ err = iso_sock_bind_pa_sk(sk, sa, addr_len);
+ goto done;
+ }
+
if (sk->sk_state != BT_OPEN) {
err = -EBADFD;
goto done;
--
2.39.2
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=794361
---Test result---
Test Summary:
CheckPatch PASS 0.82 seconds
GitLint PASS 0.38 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel PASS 40.93 seconds
CheckAllWarning PASS 43.41 seconds
CheckSparse PASS 49.51 seconds
CheckSmatch PASS 133.25 seconds
BuildKernel32 PASS 38.14 seconds
TestRunnerSetup PASS 598.77 seconds
TestRunner_l2cap-tester PASS 36.39 seconds
TestRunner_iso-tester PASS 66.55 seconds
TestRunner_bnep-tester PASS 12.14 seconds
TestRunner_mgmt-tester PASS 242.58 seconds
TestRunner_rfcomm-tester PASS 18.27 seconds
TestRunner_sco-tester PASS 21.46 seconds
TestRunner_ioctl-tester PASS 20.88 seconds
TestRunner_mesh-tester PASS 15.47 seconds
TestRunner_smp-tester PASS 16.65 seconds
TestRunner_userchan-tester PASS 12.91 seconds
IncrementalBuild PASS 36.39 seconds
---
Regards,
Linux Bluetooth
Hi,
ke, 2023-10-18 kello 17:34 +0300, Iulia Tanasescu kirjoitti:
> This makes it possible to bind a PA sync socket to a number of BISes
> before issuing the BIG Create Sync command.
>
> Signed-off-by: Iulia Tanasescu <[email protected]>
> ---
> net/bluetooth/iso.c | 40 ++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 40 insertions(+)
>
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 07b80e97aead..f20238c4702f 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -813,6 +813,37 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
> return 0;
> }
>
> +static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa,
> + int addr_len)
> +{
> + int err = 0;
> +
> + if (sk->sk_type != SOCK_SEQPACKET) {
> + err = -EINVAL;
> + goto done;
> + }
> +
> + if (addr_len <= sizeof(*sa)) {
> + err = -EINVAL;
> + goto done;
> + }
> +
This does not seem to check addr_len is big enough, sizeof(*sa) won't
count the sa->iso_bc flexible array member.
That sa->iso_bc->bc_num_bis <= ISO_MAX_NUM_BIS is not checked, so
memcpy may write out of bounds.
The values in sa come from user, so may be invalid.
iso_sock_bind_bc seems to have similar issue.
Sorry for second round comments.
> + iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
> +
> + for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
> + if (sa->iso_bc->bc_bis[i] < 0x01 ||
> + sa->iso_bc->bc_bis[i] > 0x1f) {
> + err = -EINVAL;
> + goto done;
> + }
> +
> + memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
> + iso_pi(sk)->bc_num_bis);
> +
> +done:
> + return err;
> +}
> +
> static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
> int addr_len)
> {
> @@ -828,6 +859,15 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
>
> lock_sock(sk);
>
> + /* Allow the user to bind a PA sync socket to a number
> + * of BISes to sync to.
> + */
> + if (sk->sk_state == BT_CONNECT2 &&
> + test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
> + err = iso_sock_bind_pa_sk(sk, sa, addr_len);
> + goto done;
> + }
> +
> if (sk->sk_state != BT_OPEN) {
> err = -EBADFD;
> goto done;