Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()

iso_sock_rebind_bis() updates socket iso_pi(sk)->bc_num_bis before
validating the BIS values, so it's possible to end up with bc_num_bis
inconsistent.

Assign to iso_pi(sk)->bc_num_bis only after validation.

Fixes: 80837140c1f2 ("Bluetooth: ISO: Allow binding a PA sync socket")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index e51253e5c16120a7eb4a578da15e354f9b4db8a1..5de4a2f886ebc97465c91725ab4ccf46a70238cb 100644 (file)
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1039,15 +1039,15 @@ static int iso_sock_rebind_bis(struct sock *sk, struct sockaddr_iso *sa,
                goto done;
        }
 
-       iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
-
-       for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
+       for (int i = 0; i < sa->iso_bc->bc_num_bis; i++)
                if (sa->iso_bc->bc_bis[i] < 0x01 ||
                    sa->iso_bc->bc_bis[i] > 0x1f) {
                        err = -EINVAL;
                        goto done;
                }
 
+       iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
+
        memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
               iso_pi(sk)->bc_num_bis);