3.18-stable patches

added patches:
	bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch

diff --git a/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch b/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch
new file mode 100644 (file)
index 0000000..9516254
--- /dev/null
+++ b/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch
@@ -0,0 +1,33 @@
+From 96c26653ce65bf84f3212f8b00d4316c1efcbf4c Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 19 Dec 2014 06:20:58 +0000
+Subject: Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 96c26653ce65bf84f3212f8b00d4316c1efcbf4c upstream.
+
+... rather than relying on ciptool(8) never passing it anything else.  Give
+it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,
+trying to evaluate &l2cap_pi(sock->sk)->chan->dst...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/cmtp/core.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bluetooth/cmtp/core.c
++++ b/net/bluetooth/cmtp/core.c
+@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_conn
+ 
+       BT_DBG("");
+ 
++      if (!l2cap_is_socket(sock))
++              return -EBADFD;
++
+       session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
+       if (!session)
+               return -ENOMEM;

diff --git a/queue-3.18/series b/queue-3.18/series
index dc6974bd76a0a8ef6a2b49fb267fecfc6dd52757..bf170fa61359f593d84408350fd19b96bde88dfb 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -11,3 +11,4 @@ revert-powerpc-numa-fix-percpu-allocations-to-be-numa-aware.patch
 staging-comedi-comedi_fops-avoid-orphaned-proc-entry.patch
 bluetooth-bnep-bnep_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch
 bluetooth-fix-potential-null-dereference.patch
+bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch