Re: Initializing bluetooth using socket.c userland functions broken after upgrade from 6.5 to 6.8 (and mainline 6.9, 6.10)

[Luiz Augusto von Dentz]

Hi Julio,

On Mon, Sep 9, 2024 at 4:58 PM Julio Lajara <julio@xxxxxxxxxxxxxxxxxxx> wrote:
>
> My company uses pybleno to initialize bluetooth LE devices on our IOT
> devices as GATT servers.
> This has worked fine from 4.x kernels on Ubuntu 18.04 up to 6.5.0 on
> Ubuntu 22.04 for us. The Python code interfaces
> with the socket.c userland functions AFAICT.
>
> After upgrading from 6.5 to 6.8 kernel on Ubuntu 22.04, the kernel is
> now returning
>
> "[Errno 22] Invalid Argument" from the socket.c setsockopt function.
>
> I have outline as best I can what I checked in the downstream pybleno
> ticket here: https://github.com/Adam-Langley/pybleno/issues/63
>
> I could use some input on whether on not any of the recent socket.c
> changes between 6.5 to 6.8 changes could have caused this and if
> this is a regression or whether not the Python calls to these socket.c
> functions which have worked since 4.x need to be rewritten as a result
> of an expected interface change on the kernel side.
>
> This problem exists for us as well when we tested with mainline 6.9
> and 6.10 kernels last week and our only current solution is
> downgrading to 6.5 .
>
> Thank you,

Most likely:

Author: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Date:   Fri Apr 5 16:46:50 2024 -0400

    Bluetooth: hci_sock: Fix not validating setsockopt user input

    Check user input length before copying data.

    Fixes: 09572fca7223 ("Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF")
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>

I wouldn't be surprised that people are actually not using hci_ufilter
struct when setting HCI_FILTER and the it fails at:

static inline int bt_copy_from_sockptr(void *dst, size_t dst_size,
                       sockptr_t src, size_t src_size)
{
    if (dst_size > src_size)
        return -EINVAL;

    return copy_from_sockptr(dst, src, dst_size);
}

-- 
Luiz Augusto von Dentz