]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Bluetooth: hidp: NUL terminate a string in the compat ioctl
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 16 May 2019 18:24:00 +0000 (21:24 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 26 Jul 2019 07:12:50 +0000 (09:12 +0200)
commit11f91596e0c385ae61ff2d1e2707e0d1a48c9d37
tree9918993d854771322e19b39ec9a30131fcfbde3c
parent9e8d3c92c59eabee227f9fd89715139a14e16dd8
Bluetooth: hidp: NUL terminate a string in the compat ioctl

[ Upstream commit dcae9052ebb0c5b2614de620323d615fcbfda7f8 ]

This change is similar to commit a1616a5ac99e ("Bluetooth: hidp: fix
buffer overflow") but for the compat ioctl.  We take a string from the
user and forgot to ensure that it's NUL terminated.

I have also changed the strncpy() in to strscpy() in hidp_setup_hid().
The difference is the strncpy() doesn't necessarily NUL terminate the
destination string.  Either change would fix the problem but it's nice
to take a belt and suspenders approach and do both.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/hidp/core.c
net/bluetooth/hidp/sock.c