Mathias Krause c8c499175f Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg() ...

If the socket is in state BT_CONNECT2 and BT_SK_DEFER_SETUP is set in
the flags, sco_sock_recvmsg() returns early with 0 without updating the
possibly set msg_namelen member. This, in turn, leads to a 128 byte
kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_recvmsg().

Cc: Marcel Holtmann <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Cc: Johan Hedberg <[email protected]>
Signed-off-by: Mathias Krause <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

2013-04-07 16:28:01 -04:00

..

bnep

Bluetooth: Remove unnecessary include l2cap.h

2013-01-09 17:05:05 -02:00

cmtp

Bluetooth: Replace include linux/module.h with linux/export.h

2012-10-24 00:44:05 -02:00

hidp

Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()

2013-01-09 17:39:05 -02:00

rfcomm

Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()

2013-04-07 16:28:00 -04:00

a2mp.c

Bluetooth: AMP: Use set_bit / test_bit for amp_mgr state

2013-01-09 17:05:05 -02:00

af_bluetooth.c

Bluetooth: fix possible info leak in bt_sock_recvmsg()

2013-04-07 16:28:00 -04:00

amp.c

Bluetooth: AMP: Use set_bit / test_bit for amp_mgr state

2013-01-09 17:05:05 -02:00

hci_conn.c

Bluetooth: Fix hci_conn timeout routine

2013-01-31 15:38:02 -02:00

hci_core.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-02-21 17:40:58 -08:00

hci_event.c

Bluetooth: Remove unneeded locking

2013-02-01 15:50:18 -02:00

hci_sock.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

hci_sysfs.c

Bluetooth: Fix uuid output in debugfs

2013-01-10 16:32:35 -02:00

Kconfig

Bluetooth: trivial: Remove newline before EOF

2012-10-24 00:42:47 -02:00

l2cap_core.c

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next

2013-01-30 14:21:04 -05:00

l2cap_sock.c

Bluetooth: Start channel move when socket option is changed

2012-10-24 00:26:30 -02:00

lib.c

bluetooth: Remove unneeded batostr function

2012-09-27 18:10:43 -03:00

Makefile

Bluetooth: AMP: Use HCI cmd to Read Loc AMP Assoc

2012-09-27 17:10:32 -03:00

mgmt.c

Bluetooth: Refactor mgmt_pending_foreach

2013-02-01 15:50:18 -02:00

sco.c

Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg()

2013-04-07 16:28:01 -04:00

smp.c

Bluetooth: Fix handling of unexpected SMP PDUs

2013-01-31 15:35:42 -02:00