From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Anderson Lizardo <anderson.lizardo@openbossa.org>,
Marcel Holtmann <marcel@holtmann.org>,
Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Subject: [ 11/15] Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()
Date: Fri, 1 Feb 2013 11:48:44 +0100 [thread overview]
Message-ID: <20130201104757.282044951@linuxfoundation.org> (raw)
In-Reply-To: <20130201104756.470588207@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Lizardo <anderson.lizardo@openbossa.org>
commit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream.
The length parameter should be sizeof(req->name) - 1 because there is no
guarantee that string provided by userspace will contain the trailing
'\0'.
Can be easily reproduced by manually setting req->name to 128 non-zero
bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
input subsystem:
$ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af
("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
field in struct hid_device due to overflow.)
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hidp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -934,7 +934,7 @@ static int hidp_setup_hid(struct hidp_se
hid->version = req->version;
hid->country = req->country;
- strncpy(hid->name, req->name, 128);
+ strncpy(hid->name, req->name, sizeof(req->name) - 1);
strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
next prev parent reply other threads:[~2013-02-01 10:48 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20130201104756.470588207@linuxfoundation.org>
2013-02-01 10:48 ` [ 01/15] can: c_can: fix invalid error codes Greg Kroah-Hartman
2013-02-01 10:48 ` [ 02/15] can: ti_hecc: " Greg Kroah-Hartman
2013-02-01 10:48 ` [ 03/15] can: pch_can: " Greg Kroah-Hartman
2013-02-01 10:48 ` [ 04/15] fs/cifs/cifs_dfs_ref.c: fix potential memory leakage Greg Kroah-Hartman
2013-02-01 10:48 ` [ 05/15] ARM: DMA: Fix struct page iterator in dma_cache_maint() to work with sparsemem Greg Kroah-Hartman
2013-02-01 10:48 ` [ 06/15] Bluetooth: Fix sending HCI commands after reset Greg Kroah-Hartman
2013-02-01 10:48 ` [ 07/15] ath9k_htc: Fix memory leak Greg Kroah-Hartman
2013-02-01 10:48 ` [ 08/15] ath9k: fix double-free bug on beacon generate failure Greg Kroah-Hartman
2013-02-01 10:48 ` [ 09/15] ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices Greg Kroah-Hartman
2013-02-01 10:48 ` [ 10/15] EDAC: Test correct variable in ->store function Greg Kroah-Hartman
2013-02-01 10:48 ` Greg Kroah-Hartman [this message]
2013-02-01 10:48 ` [ 12/15] smp: Fix SMP function call empty cpu mask race Greg Kroah-Hartman
2013-02-01 10:48 ` [ 13/15] x86/msr: Add capabilities check Greg Kroah-Hartman
2013-02-01 10:48 ` [ 14/15] efi, x86: Pass a proper identity mapping in efi_call_phys_prelog Greg Kroah-Hartman
2013-02-01 10:48 ` [ 15/15] x86/Sandy Bridge: Sandy Bridge workaround depends on CONFIG_PCI Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130201104757.282044951@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=anderson.lizardo@openbossa.org \
--cc=gustavo.padovan@collabora.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).