Commit 56619856 authored Dec 15, 2015 by David S. Miller Committed by Sasha Levin Jan 15, 2016

bluetooth: Validate socket address length in sco_sock_bind().



[ Upstream commit 5233252fce714053f0151680933571a2da9cbfb4 ]

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

parent 652ed6f6

net/bluetooth/sco.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -520,6 +520,9 @@ static int sco_sock_bind(struct socket sock, struct sockaddr addr, int addr_le
		if (!addr \|\| addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

		if (addr_len < sizeof(struct sockaddr_sco))
		return -EINVAL;

		lock_sock(sk);

		if (sk->sk_state != BT_OPEN) {