[PATCH] Bluetooth: hci_sock: reject out-of-range OCF values

[PATCH] Bluetooth: hci_sock: reject out-of-range OCF values

[Aldo Ariel Panzardo]

The raw HCI socket security filter has 128 OCF bits per supported OGF,
but masks the 10-bit OCF with 127 before looking up the command. An
unprivileged socket can therefore submit a reserved OCF that aliases an
allowlisted command modulo 128.

A conforming controller should reject reserved opcodes. Nevertheless,
the security decision must apply to the opcode that will actually be
sent, especially since controller-specific behavior is outside the host
stack's control.

Reject OCF values that cannot be represented by the security filter
instead of aliasing them onto an unrelated command.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 net/bluetooth/hci_sock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 070ca388f9..6413593eee 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1881,7 +1881,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 		u16 ocf = hci_opcode_ocf(opcode);
 
 		if (((ogf > HCI_SFLT_MAX_OGF) ||
-		     !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
+		     (ocf > HCI_FLT_OCF_BITS) ||
+		     !hci_test_bit(ocf,
 				   &hci_sec_filter.ocf_mask[ogf])) &&
 		    !capable(CAP_NET_RAW)) {
 			err = -EPERM;
-- 
2.43.0

Re: [PATCH] Bluetooth: hci_sock: reject out-of-range OCF values

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 13:03:58 -0300 you wrote:
> The raw HCI socket security filter has 128 OCF bits per supported OGF,
> but masks the 10-bit OCF with 127 before looking up the command. An
> unprivileged socket can therefore submit a reserved OCF that aliases an
> allowlisted command modulo 128.
> 
> A conforming controller should reject reserved opcodes. Nevertheless,
> the security decision must apply to the opcode that will actually be
> sent, especially since controller-specific behavior is outside the host
> stack's control.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sock: reject out-of-range OCF values
    https://git.kernel.org/bluetooth/bluetooth-next/c/e93fad891c72

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html