Hi Dave,
>> The following program leads to leak of 6 bytes from kernel stack:
>
> This should fix it:
>
> ====================
> [PATCH] bluetooth: Validate socket address length in sco_sock_bind().
>
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> ---
> net/bluetooth/sco.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> index fe12966..f52bcbf 100644
> --- a/net/bluetooth/sco.c
> +++ b/net/bluetooth/sco.c
> @@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
> if (!addr || addr->sa_family != AF_BLUETOOTH)
> return -EINVAL;
>
> + if (addr_len < sizeof(struct sockaddr_sco))
> + return -EINVAL;
> +
> lock_sock(sk);
>
> if (sk->sk_state != BT_OPEN) {
thanks for the patch, but I think we do the same as we do with all the other Bluetooth socket and copy it into cleared stack variable. I have a patch for that and will ask Johan to send a pull request shortly.
Regards
Marcel
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
