[v2,1/1] Bluetooth: ISO: Allow binding a PA sync socket

Commit Message

Iulia Tanasescu Oct. 18, 2023, 2:34 p.m. UTC

This makes it possible to bind a PA sync socket to a number of BISes
before issuing the BIG Create Sync command.

Signed-off-by: Iulia Tanasescu <[e-mail]>
---
 net/bluetooth/iso.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

Comments

[e-mail] Oct. 18, 2023, 3:41 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=794361

---Test result---

Test Summary:
CheckPatch                    PASS      0.82 seconds
GitLint                       PASS      0.38 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      40.93 seconds
CheckAllWarning               PASS      43.41 seconds
CheckSparse                   PASS      49.51 seconds
CheckSmatch                   PASS      133.25 seconds
BuildKernel32                 PASS      38.14 seconds
TestRunnerSetup               PASS      598.77 seconds
TestRunner_l2cap-tester       PASS      36.39 seconds
TestRunner_iso-tester         PASS      66.55 seconds
TestRunner_bnep-tester        PASS      12.14 seconds
TestRunner_mgmt-tester        PASS      242.58 seconds
TestRunner_rfcomm-tester      PASS      18.27 seconds
TestRunner_sco-tester         PASS      21.46 seconds
TestRunner_ioctl-tester       PASS      20.88 seconds
TestRunner_mesh-tester        PASS      15.47 seconds
TestRunner_smp-tester         PASS      16.65 seconds
TestRunner_userchan-tester    PASS      12.91 seconds
IncrementalBuild              PASS      36.39 seconds



---
Regards,
Linux Bluetooth

Pauli Virtanen Oct. 18, 2023, 5:05 p.m. UTC | #2

Hi,

ke, 2023-10-18 kello 17:34 +0300, Iulia Tanasescu kirjoitti:
> This makes it possible to bind a PA sync socket to a number of BISes
> before issuing the BIG Create Sync command.
> 
> Signed-off-by: Iulia Tanasescu <[e-mail]>
> ---
>  net/bluetooth/iso.c | 40 ++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 40 insertions(+)
> 
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 07b80e97aead..f20238c4702f 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -813,6 +813,37 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
>  	return 0;
>  }
>  
> +static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa,
> +			       int addr_len)
> +{
> +	int err = 0;
> +
> +	if (sk->sk_type != SOCK_SEQPACKET) {
> +		err = -EINVAL;
> +		goto done;
> +	}
> +
> +	if (addr_len <= sizeof(*sa)) {
> +		err = -EINVAL;
> +		goto done;
> +	}
> +

This does not seem to check addr_len is big enough, sizeof(*sa) won't
count the sa->iso_bc flexible array member. 

That sa->iso_bc->bc_num_bis <= ISO_MAX_NUM_BIS is not checked, so
memcpy may write out of bounds.

The values in sa come from user, so may be invalid.

iso_sock_bind_bc seems to have similar issue.

Sorry for second round comments.

> +	iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
> +
> +	for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
> +		if (sa->iso_bc->bc_bis[i] < 0x01 ||
> +		    sa->iso_bc->bc_bis[i] > 0x1f) {
> +			err = -EINVAL;
> +			goto done;
> +		}
> +
> +	memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
> +	       iso_pi(sk)->bc_num_bis);
> +
> +done:
> +	return err;
> +}
> +
>  static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
>  			 int addr_len)
>  {
> @@ -828,6 +859,15 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
>  
>  	lock_sock(sk);
>  
> +	/* Allow the user to bind a PA sync socket to a number
> +	 * of BISes to sync to.
> +	 */
> +	if (sk->sk_state == BT_CONNECT2 &&
> +	    test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
> +		err = iso_sock_bind_pa_sk(sk, sa, addr_len);
> +		goto done;
> +	}
> +
>  	if (sk->sk_state != BT_OPEN) {
>  		err = -EBADFD;
>  		goto done;

Patch

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 07b80e97aead..f20238c4702f 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -813,6 +813,37 @@  static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
 	return 0;
 }
 
+static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa,
+			       int addr_len)
+{
+	int err = 0;
+
+	if (sk->sk_type != SOCK_SEQPACKET) {
+		err = -EINVAL;
+		goto done;
+	}
+
+	if (addr_len <= sizeof(*sa)) {
+		err = -EINVAL;
+		goto done;
+	}
+
+	iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
+
+	for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
+		if (sa->iso_bc->bc_bis[i] < 0x01 ||
+		    sa->iso_bc->bc_bis[i] > 0x1f) {
+			err = -EINVAL;
+			goto done;
+		}
+
+	memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
+	       iso_pi(sk)->bc_num_bis);
+
+done:
+	return err;
+}
+
 static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
 			 int addr_len)
 {
@@ -828,6 +859,15 @@  static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
 
 	lock_sock(sk);
 
+	/* Allow the user to bind a PA sync socket to a number
+	 * of BISes to sync to.
+	 */
+	if (sk->sk_state == BT_CONNECT2 &&
+	    test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
+		err = iso_sock_bind_pa_sk(sk, sa, addr_len);
+		goto done;
+	}
+
 	if (sk->sk_state != BT_OPEN) {
 		err = -EBADFD;
 		goto done;