Bluetooth: Properly check L2CAP config option output buffer length

[pandora-kernel.git] / net / bluetooth / l2cap_core.c

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index dd7c019..01116f9 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -68,7 +68,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
                                u8 code, u8 ident, u16 dlen, void *data);
 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
                                                                void *data);
                                u8 code, u8 ident, u16 dlen, void *data);
 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
                                                                void *data);

-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);

 static void l2cap_send_disconn_req(struct l2cap_conn *conn,
                                struct l2cap_chan *chan, int err);
 
 static void l2cap_send_disconn_req(struct l2cap_conn *conn,
                                struct l2cap_chan *chan, int err);
 


@@ -787,7 +787,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                        set_bit(CONF_REQ_SENT, &chan->conf_state);
                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
 
                        set_bit(CONF_REQ_SENT, &chan->conf_state);
                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,

-                                               l2cap_build_conf_req(chan, buf), buf);
+                                      l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);

                        chan->num_conf_req++;
                }
 
                        chan->num_conf_req++;
                }
 


@@ -1825,12 +1825,15 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
        return len;
 }
 
        return len;
 }
 

-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)

 {
        struct l2cap_conf_opt *opt = *ptr;
 
        BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
 
 {
        struct l2cap_conf_opt *opt = *ptr;
 
        BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
 

+       if (size < L2CAP_CONF_OPT_SIZE + len)
+               return;
+

        opt->type = type;
        opt->len  = len;
 
        opt->type = type;
        opt->len  = len;
 


@@ -1901,11 +1904,12 @@ static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
        }
 }
 
        }
 }
 

-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)

 {
        struct l2cap_conf_req *req = data;
        struct l2cap_conf_rfc rfc = { .mode = chan->mode };
        void *ptr = req->data;
 {
        struct l2cap_conf_req *req = data;
        struct l2cap_conf_rfc rfc = { .mode = chan->mode };
        void *ptr = req->data;

+       void *endptr = data + data_size;

 
        BT_DBG("chan %p", chan);
 
 
        BT_DBG("chan %p", chan);
 


@@ -1926,7 +1930,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
 
 done:
        if (chan->imtu != L2CAP_DEFAULT_MTU)
 
 done:
        if (chan->imtu != L2CAP_DEFAULT_MTU)

-               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);

 
        switch (chan->mode) {
        case L2CAP_MODE_BASIC:
 
        switch (chan->mode) {
        case L2CAP_MODE_BASIC:


@@ -1942,7 +1946,7 @@ done:
                rfc.max_pdu_size    = 0;
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
                rfc.max_pdu_size    = 0;
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),

-                                                       (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);

                break;
 
        case L2CAP_MODE_ERTM:
                break;
 
        case L2CAP_MODE_ERTM:


@@ -1956,7 +1960,7 @@ done:
                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),

-                                                       (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);

 
                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                        break;
 
                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                        break;


@@ -1964,7 +1968,8 @@ done:
                if (chan->fcs == L2CAP_FCS_NONE ||
                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                        chan->fcs = L2CAP_FCS_NONE;
                if (chan->fcs == L2CAP_FCS_NONE ||
                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                        chan->fcs = L2CAP_FCS_NONE;

-                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs,
+                                          endptr - ptr);

                }
                break;
 
                }
                break;
 


@@ -1979,7 +1984,7 @@ done:
                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),

-                                                       (unsigned long) &rfc);
+                                  (unsigned long) &rfc, endptr - ptr);

 
                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                        break;
 
                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                        break;


@@ -1987,7 +1992,8 @@ done:
                if (chan->fcs == L2CAP_FCS_NONE ||
                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                        chan->fcs = L2CAP_FCS_NONE;
                if (chan->fcs == L2CAP_FCS_NONE ||
                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                        chan->fcs = L2CAP_FCS_NONE;

-                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs,
+                                          endptr - ptr);

                }
                break;
        }
                }
                break;
        }


@@ -1998,10 +2004,11 @@ done:
        return ptr - data;
 }
 
        return ptr - data;
 }
 

-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)

 {
        struct l2cap_conf_rsp *rsp = data;
        void *ptr = rsp->data;
 {
        struct l2cap_conf_rsp *rsp = data;
        void *ptr = rsp->data;

+       void *endptr = data + data_size;

        void *req = chan->conf_req;
        int len = chan->conf_len;
        int type, hint, olen;
        void *req = chan->conf_req;
        int len = chan->conf_len;
        int type, hint, olen;


@@ -2077,8 +2084,8 @@ done:
                if (chan->num_conf_rsp == 1)
                        return -ECONNREFUSED;
 
                if (chan->num_conf_rsp == 1)
                        return -ECONNREFUSED;
 

-               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                       sizeof(rfc), (unsigned long) &rfc);
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                  (unsigned long) &rfc, endptr - ptr);

        }
 
 
        }
 
 


@@ -2092,7 +2099,7 @@ done:
                        chan->omtu = mtu;
                        set_bit(CONF_MTU_DONE, &chan->conf_state);
                }
                        chan->omtu = mtu;
                        set_bit(CONF_MTU_DONE, &chan->conf_state);
                }

-               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);

 
                switch (rfc.mode) {
                case L2CAP_MODE_BASIC:
 
                switch (rfc.mode) {
                case L2CAP_MODE_BASIC:


@@ -2117,7 +2124,7 @@ done:
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,

-                                       sizeof(rfc), (unsigned long) &rfc);
+                                          sizeof(rfc), (unsigned long) &rfc, endptr - ptr);

 
                        break;
 
 
                        break;
 


@@ -2129,8 +2136,8 @@ done:
 
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
 
                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 

-                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                       sizeof(rfc), (unsigned long) &rfc);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                          (unsigned long) &rfc, endptr - ptr);

 
                        break;
 
 
                        break;
 


@@ -2151,10 +2158,12 @@ done:
        return ptr - data;
 }
 
        return ptr - data;
 }
 

-static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
+static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+                               void *data, size_t size, u16 *result)

 {
        struct l2cap_conf_req *req = data;
        void *ptr = req->data;
 {
        struct l2cap_conf_req *req = data;
        void *ptr = req->data;

+       void *endptr = data + size;

        int type, olen;
        unsigned long val;
        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
        int type, olen;
        unsigned long val;
        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };


@@ -2171,13 +2180,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
                                chan->imtu = L2CAP_DEFAULT_MIN_MTU;
                        } else
                                chan->imtu = val;
                                chan->imtu = L2CAP_DEFAULT_MIN_MTU;
                        } else
                                chan->imtu = val;

-                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);

                        break;
 
                case L2CAP_CONF_FLUSH_TO:
                        chan->flush_to = val;
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
                        break;
 
                case L2CAP_CONF_FLUSH_TO:
                        chan->flush_to = val;
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,

-                                                       2, chan->flush_to);
+                                          2, chan->flush_to, endptr - ptr);

                        break;
 
                case L2CAP_CONF_RFC:
                        break;
 
                case L2CAP_CONF_RFC:


@@ -2191,7 +2200,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
                        chan->fcs = 0;
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                        chan->fcs = 0;
 
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,

-                                       sizeof(rfc), (unsigned long) &rfc);
+                                          sizeof(rfc), (unsigned long) &rfc, endptr - ptr);

                        break;
                }
        }
                        break;
                }
        }


@@ -2250,7 +2259,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
                return;
 
        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                return;
 
        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,

-                       l2cap_build_conf_req(chan, buf), buf);
+                      l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);

        chan->num_conf_req++;
 }
 
        chan->num_conf_req++;
 }
 


@@ -2459,7 +2468,7 @@ sendresp:
                u8 buf[128];
                set_bit(CONF_REQ_SENT, &chan->conf_state);
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                u8 buf[128];
                set_bit(CONF_REQ_SENT, &chan->conf_state);
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,

-                                       l2cap_build_conf_req(chan, buf), buf);
+                              l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);

                chan->num_conf_req++;
        }
 
                chan->num_conf_req++;
        }
 


@@ -2509,7 +2518,7 @@ static int l2cap_connect_rsp(struct l2cap_conn *conn,
                        break;
 
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                        break;
 
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,

-                                       l2cap_build_conf_req(chan, req), req);
+                              l2cap_build_conf_req(chan, req, sizeof(req)), req);

                chan->num_conf_req++;
                break;
 
                chan->num_conf_req++;
                break;
 


@@ -2602,7 +2611,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        }
 
        /* Complete config. */
        }
 
        /* Complete config. */

-       len = l2cap_parse_conf_req(chan, rsp);
+       len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));

        if (len < 0) {
                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                goto unlock;
        if (len < 0) {
                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                goto unlock;


@@ -2635,7 +2644,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
                u8 buf[64];
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
        if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
                u8 buf[64];
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,

-                                       l2cap_build_conf_req(chan, buf), buf);
+                              l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);

                chan->num_conf_req++;
        }
 
                chan->num_conf_req++;
        }
 


@@ -2687,7 +2696,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        /* throw out any old stored conf requests */
                        result = L2CAP_CONF_SUCCESS;
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
                        /* throw out any old stored conf requests */
                        result = L2CAP_CONF_SUCCESS;
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,

-                                                               req, &result);
+                                                  req, sizeof(req), &result);

                        if (len < 0) {
                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                                goto done;
                        if (len < 0) {
                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                                goto done;