[lkml]   [2011]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[34-longterm 240/247] Bluetooth: bnep: fix buffer overflow
    From: Vasiliy Kulikov <>

    This is a commit scheduled for the next v2.6.34 longterm release.
    If you see a problem with using this for longterm, please comment.

    commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.

    Struct ca is copied from userspace. It is not checked whether the "device"
    field is NULL terminated. This potentially leads to BUG() inside of
    alloc_netdev_mqs() and/or information leak by creating a device with a name
    made of contents of kernel stack.

    Signed-off-by: Vasiliy Kulikov <>
    Signed-off-by: Gustavo F. Padovan <>
    Signed-off-by: Paul Gortmaker <>
    net/bluetooth/bnep/sock.c | 1 +
    1 files changed, 1 insertions(+), 0 deletions(-)

    diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
    index 2862f53..d935da7 100644
    --- a/net/bluetooth/bnep/sock.c
    +++ b/net/bluetooth/bnep/sock.c
    @@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
    return -EBADFD;
    + ca.device[sizeof(ca.device)-1] = 0;

    err = bnep_add_connection(&ca, nsock);
    if (!err) {

     \ /
      Last update: 2011-06-23 19:43    [W:0.030 / U:6.164 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site