android_kernel_motorola_sm6375/net/bluetooth
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Andrej Shadura 37fb0fd3fb Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
commit 5fe6caa62b07fd39cd6a28acc8f92ba2955e11a6 upstream.

Commit 9bf4e919ccad worked around an issue introduced after an innocuous
optimisation change in LLVM main:

> len is defined as an 'int' because it is assigned from
> '__user int *optlen'. However, it is clamped against the result of
> sizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit
> platforms). This is done with min_t() because min() requires compatible
> types, which results in both len and the result of sizeof() being casted
> to 'unsigned int', meaning len changes signs and the result of sizeof()
> is truncated. From there, len is passed to copy_to_user(), which has a
> third parameter type of 'unsigned long', so it is widened and changes
> signs again. This excessive casting in combination with the KCSAN
> instrumentation causes LLVM to fail to eliminate the __bad_copy_from()
> call, failing the build.

The same issue occurs in rfcomm in functions rfcomm_sock_getsockopt and
rfcomm_sock_getsockopt_old.

Change the type of len to size_t in both rfcomm_sock_getsockopt and
rfcomm_sock_getsockopt_old and replace min_t() with min().

Cc: stable@vger.kernel.org
Co-authored-by: Aleksei Vetrov <vvvvvv@google.com>
Improves: 9bf4e919ccad ("Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()")
Link: https://github.com/ClangBuiltLinux/linux/issues/2007
Link: https://github.com/llvm/llvm-project/issues/85647
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-14 19:44:36 +01:00
..
bnep Bluetooth: bnep: fix wild-memory-access in proto_unregister 2024-11-08 16:20:50 +01:00
cmtp
hidp Bluetooth: Fix race condition in hidp_session_thread 2023-04-20 12:07:35 +02:00
rfcomm Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() 2024-12-14 19:44:36 +01:00
6lowpan.c Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() 2022-12-14 11:30:45 +01:00
a2mp.c
a2mp.h
af_bluetooth.c Bluetooth: Remove debugfs directory on module init failure 2024-11-08 16:20:48 +01:00
amp.c
amp.h
ecdh_helper.c
ecdh_helper.h
hci_conn.c Bluetooth: Fix bogus check for re-auth no supported with non-ssp 2024-01-25 14:34:26 -08:00
hci_core.c Bluetooth: hci_core: Fix LE quote calculation 2024-09-04 13:14:59 +02:00
hci_debugfs.c Bluetooth: Fix TOCTOU in HCI debugfs implementation 2024-04-13 12:51:33 +02:00
hci_debugfs.h
hci_event.c Bluetooth: hci_event: set the conn encrypted before conn establishes 2024-04-13 12:51:33 +02:00
hci_request.c Bluetooth: Fix memory leak in hci_req_sync_complete() 2024-05-02 16:18:28 +02:00
hci_request.h
hci_sock.c Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name 2023-10-25 11:53:25 +02:00
hci_sysfs.c Bluetooth: Fix double free in hci_conn_cleanup 2023-11-28 16:50:14 +00:00
Kconfig
l2cap_core.c Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() 2024-08-19 05:33:46 +02:00
l2cap_sock.c Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() 2024-05-02 16:18:36 +02:00
leds.c
leds.h
lib.c
Makefile
mgmt.c Bluetooth: MGMT: Add error handling to pair_device() 2024-09-04 13:15:01 +02:00
mgmt_util.c
mgmt_util.h
sco.c Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout 2024-05-17 11:43:53 +02:00
selftest.c
selftest.h
smp.c
smp.h