Commit 43629f8f authored Feb 14, 2011 by Vasiliy Kulikov Committed by Gustavo Padovan Feb 14, 2011

Bluetooth: bnep: fix buffer overflow



Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

parent d9f51b51

net/bluetooth/bnep/sock.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
		sockfd_put(nsock);
		return -EBADFD;
		}
		ca.device[sizeof(ca.device)-1] = 0;

		err = bnep_add_connection(&ca, nsock);
		if (!err) {