From: Al Viro <viro@ZenIV.linux.org.uk>
To: David Miller <davem@davemloft.net>
Cc: Marcel Holtmann <marcel@holtmann.org>,
netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org
Subject: [PATCH 2/3] cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
Date: Fri, 19 Dec 2014 06:20:58 +0000 [thread overview]
Message-ID: <1418970059-32486-2-git-send-email-viro@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20141219061801.GU22149@ZenIV.linux.org.uk>
From: Al Viro <viro@zeniv.linux.org.uk>
... rather than relying on ciptool(8) never passing it anything else. Give
it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,
trying to evaluate &l2cap_pi(sock->sk)->chan->dst...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
net/bluetooth/cmtp/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 67fe5e8..fd57db8 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -333,6 +333,8 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
int i, err;
BT_DBG("");
+ if (!l2cap_is_socket(sock))
+ return -EBADFD;
session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
if (!session)
--
2.1.3
next prev parent reply other threads:[~2014-12-19 6:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-19 6:18 [patches] a bunch of old bluetooth fixes Al Viro
2014-12-19 6:20 ` [PATCH 1/3] bluetooth: hidp_connection_add() unsafe use of l2cap_pi() Al Viro
2014-12-19 12:49 ` Marcel Holtmann
2014-12-19 6:20 ` Al Viro [this message]
2014-12-19 12:48 ` [PATCH 2/3] cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket Marcel Holtmann
2014-12-19 6:20 ` [PATCH 3/3] bnep: bnep_add_connection() " Al Viro
2014-12-19 12:48 ` Marcel Holtmann
2014-12-19 10:28 ` [patches] a bunch of old bluetooth fixes Marcel Holtmann
2014-12-19 10:30 ` Marcel Holtmann
[not found] ` <07BDA2A2-1560-4F78-A0B2-FC25E312CACE-kz+m5ild9QBg9hUCZPvPmw@public.gmane.org>
2014-12-19 16:59 ` David Miller
2014-12-19 18:25 ` Marcel Holtmann
[not found] ` <B0609FEE-1CE5-4618-A0B6-B2B82B1EC74D-kz+m5ild9QBg9hUCZPvPmw@public.gmane.org>
2014-12-19 12:57 ` Marcel Holtmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1418970059-32486-2-git-send-email-viro@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=davem@davemloft.net \
--cc=linux-bluetooth@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).