linux-stable.git/include/net/bluetooth/bluetooth.h, branch linux-5.15.y

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2025-05-02T05:44:25+00:00

commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb upstream.

conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
sco_sk_list.

Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465
Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Xiangyu Chen 
Signed-off-by: He Zhe 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: SCO: Fix not validating setsockopt user input

2025-02-01T17:24:01+00:00

commit 51eda36d33e43201e7a4fd35232e069b2c850b01 upstream.

syzbot reported sco_sock_setsockopt() is copying data without
checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset
include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr
include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90
net/bluetooth/sco.c:893
Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

Fixes: ad10b1a48754 ("Bluetooth: Add Bluetooth socket voice option")
Fixes: b96e9c671b05 ("Bluetooth: Add BT_DEFER_SETUP option to sco socket")
Fixes: 00398e1d5183 ("Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections")
Fixes: f6873401a608 ("Bluetooth: Allow setting of codec for HFP offload use case")
Reported-by: syzbot 
Signed-off-by: Eric Dumazet 
Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Sasha Levin 
Signed-off-by: Keerthana K 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks

2022-07-29T15:25:30+00:00

commit 29fb608396d6a62c1b85acc421ad7a4399085b9f upstream.

Since bt_skb_sendmmsg can be used with the likes of SOCK_STREAM it
shall return the partial chunks it could allocate instead of freeing
everything as otherwise it can cause problems like bellow.

Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg")
Reported-by: Paul Menzel 
Link: https://lore.kernel.org/r/d7206e12-1b99-c3be-84f4-df22af427ef5@molgen.mpg.de
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215594
Signed-off-by: Luiz Augusto von Dentz 
Tested-by: Paul Menzel  (Nokia N9 (MeeGo/Harmattan)
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix passing NULL to PTR_ERR

2022-07-29T15:25:30+00:00

commit 266191aa8d14b84958aaeb5e96ee4e97839e3d87 upstream.

Passing NULL to PTR_ERR will result in 0 (success), also since the likes of
bt_skb_sendmsg does never return NULL it is safe to replace the instances of
IS_ERR_OR_NULL with IS_ERR when checking its return.

Reported-by: Dan Carpenter 
Tested-by: Tedd Ho-Jeong An 
Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmmsg helper

2022-07-29T15:25:30+00:00

commit 97e4e80299844bb5f6ce5a7540742ffbffae3d97 upstream.

This works similarly to bt_skb_sendmsg but can split the msg into
multiple skb fragments which is useful for stream sockets.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmsg helper

2022-07-29T15:25:29+00:00

commit 38f64f650dc0e44c146ff88d15a7339efa325918 upstream.

bt_skb_sendmsg helps takes care of allocation the skb and copying the
the contents of msg over to the skb while checking for possible errors
so it should be safe to call it without holding lock_sock.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}

2022-04-13T18:59:08+00:00

[ Upstream commit 9b392e0e0b6d026da5a62bb79a08f32e27af858e ]

This fixes attemting to print hdev->name directly which causes them to
print an error:

kernel: read_version:367: (efault): sock 000000006a3008f2

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin

Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers

2020-07-28T07:09:00+00:00

For some reason they tend to squat on the very first CSR/
Cambridge Silicon Radio VID/PID instead of paying fees.

This is an extremely common problem; the issue goes as back as 2013
and these devices are only getting more popular, even rebranded by
reputable vendors and sold by retailers everywhere.

So, at this point in time there are hundreds of modern dongles reusing
the ID of what originally was an early Bluetooth 1.1 controller.

Linux is the only place where they don't work due to spotty checks
in our detection code. It only covered a minimum subset.

So what's the big idea? Take advantage of the fact that all CSR
chips report the same internal version as both the LMP sub-version and
HCI revision number. It always matches, couple that with the manufacturer
code, that rarely lies, and we now have a good idea of who is who.

Additionally, by compiling a list of user-reported HCI/lsusb dumps, and
searching around for legit CSR dongles in similar product ranges we can
find what CSR BlueCore firmware supported which Bluetooth versions.

That way we can narrow down ranges of fakes for each of them.

e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
     support BT 1.1 only; so it's a dead giveaway when some
     third-party BT 4.0 dongle reuses it.

So, to sum things up; there are multiple classes of fake controllers
reusing the same 0A12:0001 VID/PID. This has been broken for a while.

Known 'fake' bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
  IC markings on 0x7558: FR3191AHAL 749H15143 (???)

https://bugzilla.kernel.org/show_bug.cgi?id=60824

Fixes: 81cac64ba258ae (Deal with USB devices that are faking CSR vendor)
Reported-by: Michał Wiśniewski 
Tested-by: Mike Johnson 
Tested-by: Ricardo Rodrigues 
Tested-by: M.Hanny Sabbagh 
Tested-by: Oussama BEN BRAHIM 
Tested-by: Ismael Ferreras Morezuelas 
Signed-off-by: Ismael Ferreras Morezuelas 
Signed-off-by: Marcel Holtmann

Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections

2020-06-12T13:08:49+00:00

This change adds support for reporting the BT_PKT_STATUS to the socket
CMSG data to allow the implementation of a packet loss correction on
erroneous data received on the SCO socket.

The patch was partially developed by Marcel Holtmann and validated by
Hsin-yu Chao.

Signed-off-by: Alain Michaud 
Signed-off-by: Marcel Holtmann

Bluetooth: Introduce debug feature when dynamic debug is disabled

2020-05-11T10:16:27+00:00

In case dynamic debug is disabled, this feature allows a vendor platform
to provide debug statement printing.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg