Date:   Fri, 7 Jan 2022 10:16:44 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Marcel Holtmann <marcel@holtmann.org>, hch@lst.de
Cc:     Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        Stefan Schmidt <stefan@datenfreihafen.org>,
        Matthieu Baerts <matthieu.baerts@tessares.net>,
        linux-bluetooth@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] Bluetooth: L2CAP: uninitialized variables in
 l2cap_sock_setsockopt()
Message-ID: <20220107071644.GC22086@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?w8zjELYz/2ZDS3VbwNg7qixz3FmVxGxcIaCREul8v5siG7eFafSxjAtusVz9?=
 =?us-ascii?Q?IuuDFR+EYWC1DxSn3wtaYCWXMD1HZRu2b+SLhPkieoX92jstjlWa3LfQ90qy?=
 =?us-ascii?Q?3J28uZfMgXKdPvDwYBjVavqZcRYljxJKJrM9z6inQVNEA+tV+p4vqTI6o4OV?=
 =?us-ascii?Q?5lNHFBdc/dCG02gR/ngqjwJZoz9sUtTuX0rlXuu7QUVB9KdGGNkL4tf4rLwp?=
 =?us-ascii?Q?63JWCrTRR2yqWWnrEOpUUn5jeAAMtRQvlnsuIEVKARdJqRPP54g4yPKdkXIU?=
 =?us-ascii?Q?v7y2G9362v9Wa4f6KC34z4p3LwvIwFCSH7I2L68e3EPqa9Y+RzHueUblqMlQ?=
 =?us-ascii?Q?GI+RVMD94ZPxh8NemBxcxXXi1mgYTANIskkPUMMBU7SCJiBfvZC3d56UfyOy?=
 =?us-ascii?Q?t7/N4x3X18RJUguE3TdMuZkBIaHWdLAwLaYCvAiFadOKyGpxTVzpqyqYOVII?=
 =?us-ascii?Q?sVK5+eLut2TsLC/ZbWUYiKwGxCNMtTEGGAq14UKFvFq1NneNnlYvXW7F2LNO?=
 =?us-ascii?Q?xlyAflsQ1+WbSOY/RdN980R0OOz6D1XPc3R8hVQbEcq7ZLQ6bvcUtPxTKUZr?=
 =?us-ascii?Q?gw0Zgz5HQaoQuWVb5kfsAUvrICXdwxUPcnq2fP8J6FHysLOEZX94O47hFkuW?=
 =?us-ascii?Q?8AFbOMkIN23okoZ9f5UQPYA0M4qQCGktUWSFHJPEnr5WG4mlOJmn1S1BcM4t?=
 =?us-ascii?Q?lz6FQj09WVa34whXBhbysXhoFc/yMJqMfUNHwGxblkIwHF5yRQyEgm1+VdhV?=
 =?us-ascii?Q?fmBSz3I0L17bzIvbxYeqeqvHxijStPgOdSy3NaLUwcFfyVPIdU21B9wZ81ms?=
 =?us-ascii?Q?whAFpzZg6Jt+FomUbxTPgLLFhJvpuGMBa1DTxALLKhs9Cs5NIHLiUYMTcLVq?=
 =?us-ascii?Q?PO1XmynJvneg+in+s1Svb5YnVkxoYytrwXxBZ52hu9Lz2Vew2lzl5QbA1MtJ?=
 =?us-ascii?Q?0xEkyXO/+1JkbZQXYtgZ03iTod0bH3PKZKqARXv/nSTOiHL79igbMax0tUrZ?=
 =?us-ascii?Q?c7ONOgiiGQUtUjJUopQszC/GMuDo5mKIIK2ocZ+pepBSAE7hkWF46+74fKGZ?=
 =?us-ascii?Q?0IusxIQ2Tkk5mJwma1MihZxThZZZJt1XOELpR2W8cNflXEGSXJ9pBj4t6UPM?=
 =?us-ascii?Q?MQUSmDnFd93JmESqb/SBgXqEZ3yHrqGz9l/bhuoVeblCX3BmtXwbY8PWiPb4?=
 =?us-ascii?Q?v83WIOKs7xBvlr11zigFzcJMzJup3MV5gXvnYRIJj7NIKLtIuJnk0tpNtavc?=
 =?us-ascii?Q?Ks3ngR2Kh/zxvUSEBb26MfBq3C1bsy+2z7gP7CknFpQ3ya0uq4GlReUWVtmz?=
 =?us-ascii?Q?Ajlrs4J6BJV4/BpnrvdEnuSarAWr4qjqRGElCmwwv0iKMaxT3SarGhHvNsZp?=
 =?us-ascii?Q?vIjSLusLyNZ4twJYlZkBCAP/buLvPeCAP3ml5Y/ga8fC4cQhESeF/HCj0/YL?=
 =?us-ascii?Q?lhkFw+cHqMhNogunr9begqONMtmy3NPDlNGRAP7RLWDuGY+mbnlWGTk7czvC?=
 =?us-ascii?Q?F+HK2C96TxeRrXE3LfN4n3dqBE2Izga+opf0kWwsPoUNc9sErY/cuT/n8fDS?=
 =?us-ascii?Q?wJY7/FyRlO/CTsNKxn896s704UtYgqaBIK12NSuHoK+EDQo5w30nm8cLOIVV?=
 =?us-ascii?Q?gQWy5YrV3BA8D4A3s3eMuK8BwUADrwoAkMrClmayoSWinPGJxLl4QD8uYV1i?=
 =?us-ascii?Q?wbzGtJ982ea92x1ow8Rne8se/Xw=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e1e223de-c3b9-40c6-a13e-08d9d1adb019
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2022 07:16:56.6308
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: mMVk0zjyoPp2Px61XhlukXl3kg1Y7IoSFVr8BvSmf/YJDnLbm0PH/JKViKSMtIqo53wjs4sfbC51XxKjUku4kib8I/PvbtMNdPWv9Jhw+s4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1246
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10219 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 malwarescore=0
 mlxlogscore=999 adultscore=0 suspectscore=0 mlxscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2201070052
X-Proofpoint-ORIG-GUID: yXsl7GTSynxxgCDrLMVjTqb5skZwxxaB
X-Proofpoint-GUID: yXsl7GTSynxxgCDrLMVjTqb5skZwxxaB
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

The "opt" variable is a u32, but on some paths only the top bytes
were initialized and the others contained random stack data.

Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 net/bluetooth/l2cap_sock.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 188e4d4813b0..ca8f07f3542b 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -904,6 +904,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 	struct l2cap_conn *conn;
 	int len, err = 0;
 	u32 opt;
+	u16 mtu;
+	u8 mode;
 
 	BT_DBG("sk %p", sk);
 
@@ -1086,16 +1088,16 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u16))) {
+		if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
 			err = -EFAULT;
 			break;
 		}
 
 		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
 		    sk->sk_state == BT_CONNECTED)
-			err = l2cap_chan_reconfigure(chan, opt);
+			err = l2cap_chan_reconfigure(chan, mtu);
 		else
-			chan->imtu = opt;
+			chan->imtu = mtu;
 
 		break;
 
@@ -1117,14 +1119,14 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u8))) {
+		if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
 			err = -EFAULT;
 			break;
 		}
 
-		BT_DBG("opt %u", opt);
+		BT_DBG("mode %u", mode);
 
-		err = l2cap_set_mode(chan, opt);
+		err = l2cap_set_mode(chan, mode);
 		if (err)
 			break;
 
-- 
2.20.1