Date:   Fri, 7 Jan 2022 10:17:27 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Marcel Holtmann <marcel@holtmann.org>,
        Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc:     hch@lst.de, Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        linux-bluetooth@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] Bluetooth: hci_sock: fix endian bug in hci_sock_setsockopt()
Message-ID: <20220107071727.GD22086@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MJI0WW50byogEmTFXLcnuOCDJI14Vji2Vr01VEYnlKUj48DsmdIGKgU8noNA?=
 =?us-ascii?Q?mvbYZbYCsjD955Gg/tQ2PMbuF8bMAPG5jQ9E05Iu4Lx85taxRZjdjfgmXtiv?=
 =?us-ascii?Q?QQ7s+h5LsZjugKcLpJH63LJ7V2T6cMzSEXyqGetMZHlC+ZAOL03KXJWek153?=
 =?us-ascii?Q?wuIWEcMF6GXf5FM44Q5/GGHs2iqfLa9vFa40BVAwc+aB9PLe3zV8T6zPahn6?=
 =?us-ascii?Q?o0n6+uiSZkkl7lVBtCb+jAmsR8NaE2XZISztiwtRkqhNKS8APksVDfw/kXp4?=
 =?us-ascii?Q?9gswcstuJBNhy/ZeQ9kDtpfqmMaM8YN0/eskZHhTrpUpGWcUqiSqWRcn+nYH?=
 =?us-ascii?Q?gTxLUwET62DvGeCwOsD2mIbvcAo/bu8bRjhDckVeopGNO21ejClr/MJoZVYW?=
 =?us-ascii?Q?VUH5EYMCmMXsFHIQXUGMBAkB7sYgynQZAbiS+Y91qUfv+jXdGiAzc6yahsCC?=
 =?us-ascii?Q?E7RtnyCcdrf5Nme7uHtASy+Na6cGasyJ+jDBKAlptglWfn2RX2wkLAPcTAaP?=
 =?us-ascii?Q?cOh5coxu/QYeMmfruxbiwHJ68Q5nv2u9pw8aq56t1HaFjtLsZjLF/aFsBDdt?=
 =?us-ascii?Q?28MtekesKavL5JQDgl10uLxbO3oUuter4ZkyYK/1Ac/j4EiLKbCrU5DzyNZz?=
 =?us-ascii?Q?/HMkpT39+1g77QcBtQp/slwFNKBsGfTQ7YLV70TZqr514ukxLt/f6Y31vx+m?=
 =?us-ascii?Q?Js4sR/AIQ9YdsnpFocomV6+Sqdf00Jk62LI8TP3feAux6D7RYpg6Rn2BYfGv?=
 =?us-ascii?Q?RX05qmTmrQb2FkaWp31jMzqhw8NzsAUv/bs1R+gDWi/2dKg6HbRvoPVas7CN?=
 =?us-ascii?Q?pkPQW2zzmlgxND6XaLTwcqhkc5TSAyah32MCx4RWrO/sUyJUy6m11Z9i8e7U?=
 =?us-ascii?Q?xDtBujhIThO9W4TBTi4ypp0vHtKOg7KlfUXILmLmSBEBITeLdjuFpe/JKBId?=
 =?us-ascii?Q?OZPqZKHOiiHF+3wC3DzOCn8/TeQnDK6apUK+/AhXw9JzlnAWh3X2oHoz8FSZ?=
 =?us-ascii?Q?tsAobT2PW862qWa95TNgH2tOuS6u6RDIhM3vhQ1KPWkFJQcYlfoDVqumGlos?=
 =?us-ascii?Q?Hmyzenv3R/VOzA1hq5Hk/5jqAmb7bSSM8tKogZg/2xnRJKdBfSr0Aqk434BI?=
 =?us-ascii?Q?ZLStZtQlpS5sKxEEMa/GGdcAgZrp7E21yjgvW6jfPfWEitMot0q5WUBbzMzx?=
 =?us-ascii?Q?InTQX1gEQka7E8g5wb+YUgp24RlTS/uP1tv+N6VkIdBcq6pP7175SkmphV4T?=
 =?us-ascii?Q?SyBL/3DzSr+JyAG8Oj06YIPo/1qmsiGlTmYm3KPerG143NTua6k5kgJLpW12?=
 =?us-ascii?Q?osa51eXaazJGp4mzvxDzLQS0FdDLcCLG0B4XKpzNyQi7IxGIHrgvWto6bsX9?=
 =?us-ascii?Q?JLejRgLnjhBeqtzfVuxJmVsHHBChJv4C33fBIKg0iyqgZII9GriAdkRfuDuj?=
 =?us-ascii?Q?hRo8zEqPnlVLajMApsBd6si+QW8NJbbRsyGtngMhwsGbEubjGlIll8lmgjsy?=
 =?us-ascii?Q?S9ay63a0B5fxW8VAvgvz97C2XXOAFTJe6FEQ81u+Z5xevRB8q7OWcjrkz4yC?=
 =?us-ascii?Q?esFtFYhJxTmPTdCpp6G1WzjlVB7m69nigt+uNqoIcz7ABxnXp9gKBGOxnPqD?=
 =?us-ascii?Q?nL5TSuylyjO++TbsO2GcVpZbF06Ti0Qq/9k7aKZh6vv1SiQ5vD08xXYl/MQf?=
 =?us-ascii?Q?DQbU31HvOR4S8YU3zerks2hCE8s=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f05fe8b3-045d-4f69-b5a6-08d9d1adc98a
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2022 07:17:39.1431
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ztv496O/25zneboHbYfrqG9RFQTS7EgGEf4wCYnzWFTphiwYx1CAld6MK7pGOkZwgC/W9CJG/ZuqgRlQGa/TAQ43Ipv3vc3F/hrhRUlKX5k=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6PR10MB5554
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10219 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999
 suspectscore=0 phishscore=0 spamscore=0 bulkscore=0 adultscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2201070052
X-Proofpoint-ORIG-GUID: 5_I0n5Ydbfy7hgt3U1OVwtuWSbkb-X4g
X-Proofpoint-GUID: 5_I0n5Ydbfy7hgt3U1OVwtuWSbkb-X4g
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

This copies a u16 into the high bits of an int, which works on a big
endian system but not on a little endian system.

Fixes: 09572fca7223 ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 net/bluetooth/hci_sock.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 446573a12571..33b3c0ffc339 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1911,7 +1911,8 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 			       sockptr_t optval, unsigned int len)
 {
 	struct sock *sk = sock->sk;
-	int err = 0, opt = 0;
+	int err = 0;
+	u16 opt;
 
 	BT_DBG("sk %p, opt %d", sk, optname);
 
@@ -1937,7 +1938,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 			goto done;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u16))) {
+		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
 			err = -EFAULT;
 			break;
 		}
-- 
2.20.1