diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2019-04-12 12:54:33 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-12 19:25:03 +0200 |
| commit | bd7d46ddca06f1fadd68ceb99bc6e6f808ab50f2 (patch) | |
| tree | 3ecb7b934cac41a04e79df65b7708deb254473ff /net | |
| parent | rxrpc: Check address length before reading srx_service field (diff) | |
| download | linux-bd7d46ddca06f1fadd68ceb99bc6e6f808ab50f2.tar.xz linux-bd7d46ddca06f1fadd68ceb99bc6e6f808ab50f2.zip | |
Bluetooth: Check address length before reading address field
KMSAN will complain if valid address length passed to bind() is shorter
than sizeof(struct sockaddr_sco) bytes.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/sco.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 9a580999ca57..d892b7c3cc42 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -523,12 +523,12 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, struct sock *sk = sock->sk; int err = 0; - BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); - if (!addr || addr_len < sizeof(struct sockaddr_sco) || addr->sa_family != AF_BLUETOOTH) return -EINVAL; + BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); + lock_sock(sk); if (sk->sk_state != BT_OPEN) { |