David Miller
unread,Dec 15, 2015, 3:39:30 PM12/15/15Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to dvy...@google.com, mar...@holtmann.org, gus...@padovan.org, johan....@gmail.com, linux-b...@vger.kernel.org, net...@vger.kernel.org, linux-...@vger.kernel.org, syzk...@googlegroups.com, k...@google.com, gli...@google.com, sasha...@oracle.com, edum...@google.com, kees...@google.com, han...@stressinduktion.org, ursula...@de.ibm.com, linux...@vger.kernel.org, lauro.v...@openbossa.org, aloisio...@openbossa.org, sa...@linux.intel.com
From: Dmitry Vyukov <
dvy...@google.com>
Date: Tue, 15 Dec 2015 21:02:30 +0100
> The following program leads to leak of 6 bytes from kernel stack:
This should fix it:
====================
[PATCH] bluetooth: Validate socket address length in sco_sock_bind().
Signed-off-by: David S. Miller <
da...@davemloft.net>
---
net/bluetooth/sco.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index fe12966..f52bcbf 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
if (!addr || addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
+ if (addr_len < sizeof(struct sockaddr_sco))
+ return -EINVAL;
+
lock_sock(sk);
if (sk->sk_state != BT_OPEN) {
--
2.4.1