| From | Greg Kroah-Hartman <> | Subject | [ 09/42] Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg() | Date | Mon, 29 Apr 2013 12:01:51 -0700 |
| |
3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
[ Upstream commit c8c499175f7d295ef867335bceb9a76a2c3cdc38 ]
If the socket is in state BT_CONNECT2 and BT_SK_DEFER_SETUP is set in the flags, sco_sock_recvmsg() returns early with 0 without updating the possibly set msg_namelen member. This, in turn, leads to a 128 byte kernel stack leak in net/socket.c.
Fix this by updating msg_namelen in this case. For all other cases it will be handled in bt_sock_recvmsg().
Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/bluetooth/sco.c | 1 + 1 file changed, 1 insertion(+)
--- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -667,6 +667,7 @@ static int sco_sock_recvmsg(struct kiocb test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { hci_conn_accept(pi->conn->hcon, 0); sk->sk_state = BT_CONFIG; + msg->msg_namelen = 0; release_sock(sk); return 0;
|