* [patch] Bluetooth: check for (harmless) underflow
@ 2013-05-30 8:05 Dan Carpenter
2013-05-31 0:02 ` Gustavo Padovan
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-05-30 8:05 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Gustavo Padovan, Johan Hedberg, open list:BLUETOOTH SUBSYSTEM,
kernel-janitors
"len" can be negative here. It's harmless but pretty subtle and
scary looking so lets add a check for it.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a1b7a02..438f39e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4069,6 +4069,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
result, len);
+ if (len < 0)
+ return -EINVAL;
+
chan = l2cap_get_chan_by_scid(conn, scid);
if (!chan)
return 0;
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] Bluetooth: check for (harmless) underflow
2013-05-30 8:05 [patch] Bluetooth: check for (harmless) underflow Dan Carpenter
@ 2013-05-31 0:02 ` Gustavo Padovan
0 siblings, 0 replies; 2+ messages in thread
From: Gustavo Padovan @ 2013-05-31 0:02 UTC (permalink / raw)
To: Dan Carpenter
Cc: Marcel Holtmann, Johan Hedberg, open list:BLUETOOTH SUBSYSTEM,
kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 915 bytes --]
Hi Dan,
* Dan Carpenter <dan.carpenter@oracle.com> [2013-05-30 11:05:10 +0300]:
> "len" can be negative here. It's harmless but pretty subtle and
> scary looking so lets add a check for it.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index a1b7a02..438f39e 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4069,6 +4069,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
> BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
> result, len);
>
> + if (len < 0)
> + return -EINVAL;
> +
> chan = l2cap_get_chan_by_scid(conn, scid);
> if (!chan)
> return 0;
We already pushed to bluetooth.git a more comprehensive patch to fix this
issue and others over the code. Thanks anyway for sending this.
Gustavo
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-05-31 0:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-30 8:05 [patch] Bluetooth: check for (harmless) underflow Dan Carpenter
2013-05-31 0:02 ` Gustavo Padovan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).