[PATCH v1 2/2] Bluetooth: ISO: require CAP_NET_BIND_SERVICE to bind

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

ISO sockets have no PSM or port namespace: binding one reserves the
ability to accept any incoming CIS or to sync to broadcast streams on
the adapter. That is equivalent to listening on a well-known service,
which L2CAP already restricts to CAP_NET_BIND_SERVICE in
l2cap_validate_bredr_psm()/l2cap_validate_le_psm().

Apply the same restriction to iso_sock_bind() so unprivileged processes
can no longer hijack incoming ISO links.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/iso.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 75bfd5938b2e..4e1e34ffc294 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1200,6 +1200,13 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
 	    addr->sa_family != AF_BLUETOOTH)
 		return -EINVAL;
 
+	/* Binding an ISO socket reserves the ability to accept any incoming
+	 * CIS/BIS on the adapter, so restrict it in the same way L2CAP
+	 * restricts well-known PSMs.
+	 */
+	if (!capable(CAP_NET_BIND_SERVICE))
+		return -EACCES;
+
 	lock_sock(sk);
 
 	if ((sk->sk_state == BT_CONNECT2 || sk->sk_state == BT_CONNECTED) &&
-- 
2.54.0