diff options
| author | Mat Martineau <mathewm@codeaurora.org> | 2010-09-08 10:05:26 -0700 |
|---|---|---|
| committer | Gustavo F. Padovan <padovan@profusion.mobi> | 2010-10-12 12:44:51 -0300 |
| commit | 0fba2558cbb3fae3a09147b7d6e18a6204204e0e (patch) | |
| tree | 48f5424c4b3530a2b39f5e5bc164db194ae10ae3 /net/bluetooth | |
| parent | 08601469a5aac8b3453d8aca0b8f9bd8dfdae12c (diff) | |
| download | op-kernel-dev-0fba2558cbb3fae3a09147b7d6e18a6204204e0e.zip op-kernel-dev-0fba2558cbb3fae3a09147b7d6e18a6204204e0e.tar.gz | |
Bluetooth: Validate PSM values in calls to connect() and bind()
Valid L2CAP PSMs are odd numbers, and the least significant bit of the
most significant byte must be 0.
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/l2cap.c | 25 |
1 files changed, 21 insertions, 4 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 0b54b7d..2f625b8 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -1008,10 +1008,20 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) goto done; } - if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 && - !capable(CAP_NET_BIND_SERVICE)) { - err = -EACCES; - goto done; + if (la.l2_psm) { + __u16 psm = __le16_to_cpu(la.l2_psm); + + /* PSM must be odd and lsb of upper byte must be 0 */ + if ((psm & 0x0101) != 0x0001) { + err = -EINVAL; + goto done; + } + + /* Restrict usage of well-known PSMs */ + if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) { + err = -EACCES; + goto done; + } } write_lock_bh(&l2cap_sk_list.lock); @@ -1190,6 +1200,13 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al goto done; } + /* PSM must be odd and lsb of upper byte must be 0 */ + if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && + sk->sk_type != SOCK_RAW) { + err = -EINVAL; + goto done; + } + /* Set destination address and psm */ bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr); l2cap_pi(sk)->psm = la.l2_psm; |
