diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2014-12-19 07:20:58 +0100 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2014-12-19 13:48:21 +0100 |
| commit | 96c26653ce65bf84f3212f8b00d4316c1efcbf4c (patch) | |
| tree | 3c3b126c115469e4bd0413b92b2919c912edb964 /net/bluetooth/cmtp | |
| parent | Bluetooth: hidp_connection_add() unsafe use of l2cap_pi() (diff) | |
| download | linux-96c26653ce65bf84f3212f8b00d4316c1efcbf4c.tar.xz linux-96c26653ce65bf84f3212f8b00d4316c1efcbf4c.zip | |
Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
... rather than relying on ciptool(8) never passing it anything else. Give
it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,
trying to evaluate &l2cap_pi(sock->sk)->chan->dst...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth/cmtp')
| -rw-r--r-- | net/bluetooth/cmtp/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 67fe5e84e68f..278a194e6af4 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) BT_DBG(""); + if (!l2cap_is_socket(sock)) + return -EBADFD; + session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL); if (!session) return -ENOMEM; |