From: Greg Kroah-Hartman Date: Thu, 3 Aug 2017 20:03:59 +0000 (-0700) Subject: 3.18-stable patches X-Git-Tag: v4.12.5~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=503cb546b27219b39fc2243c90dbcaad4468ef59;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch --- diff --git a/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch b/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch new file mode 100644 index 00000000000..951625471ae --- /dev/null +++ b/queue-3.18/bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch @@ -0,0 +1,33 @@ +From 96c26653ce65bf84f3212f8b00d4316c1efcbf4c Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Fri, 19 Dec 2014 06:20:58 +0000 +Subject: Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket + +From: Al Viro + +commit 96c26653ce65bf84f3212f8b00d4316c1efcbf4c upstream. + +... rather than relying on ciptool(8) never passing it anything else. Give +it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops, +trying to evaluate &l2cap_pi(sock->sk)->chan->dst... + +Signed-off-by: Al Viro +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/cmtp/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/cmtp/core.c ++++ b/net/bluetooth/cmtp/core.c +@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_conn + + BT_DBG(""); + ++ if (!l2cap_is_socket(sock)) ++ return -EBADFD; ++ + session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL); + if (!session) + return -ENOMEM; diff --git a/queue-3.18/series b/queue-3.18/series index dc6974bd76a..bf170fa6135 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -11,3 +11,4 @@ revert-powerpc-numa-fix-percpu-allocations-to-be-numa-aware.patch staging-comedi-comedi_fops-avoid-orphaned-proc-entry.patch bluetooth-bnep-bnep_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch bluetooth-fix-potential-null-dereference.patch +bluetooth-cmtp-cmtp_add_connection-should-verify-that-it-s-dealing-with-l2cap-socket.patch