Young Xiao
c6d1f9b4b2
Bluetooth: hidp: fix buffer overflow ...
commit a1616a5ac99ede5d605047a9012481ce7ff18b16 upstream.
Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.
This vulnerability is similar to CVE-2011-1079.
Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-10 17:54:11 +02:00
net: remove sock_no_poll
2018-05-26 09:16:44 +02:00
Merge branch 'work.aio-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-06-04 13:57:43 -07:00
Bluetooth: hidp: fix buffer overflow
2019-05-10 17:54:11 +02:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
6lowpan: fix set not used warning
2017-07-25 12:31:37 -07:00
Bluetooth: Use bt_dev_err and bt_dev_info when possible
2017-10-30 12:25:45 +02:00
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
Bluetooth: Use bt_dev_err and bt_dev_info when possible
2017-10-30 12:25:45 +02:00
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
Bluetooth: let the crypto subsystem generate the ecc privkey
2017-10-06 20:35:47 +02:00
Bluetooth: let the crypto subsystem generate the ecc privkey
2017-10-06 20:35:47 +02:00
Bluetooth: Implement Set ADV set random address
2018-07-30 13:44:53 +02:00
Bluetooth: Fix debugfs NULL pointer dereference
2019-04-20 09:16:01 +02:00
Bluetooth: Store Resolv list size
2018-07-06 12:40:08 +02:00
Bluetooth: Provide option to enable/disable debugfs information
2015-02-15 18:54:13 +02:00
Bluetooth: Fix unnecessary error message for HCI request completion
2019-01-26 09:32:44 +01:00
Bluetooth: Implement secondary advertising on different PHYs
2018-07-30 13:44:53 +02:00
Bluetooth: Implement Set ADV set random address
2018-07-30 13:44:53 +02:00
Bluetooth: Fix decrementing reference count twice in releasing socket
2019-03-27 14:14:42 +09:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-11-04 09:26:51 +09:00
Revert "Bluetooth: Add option for disabling legacy ioctl interfaces"
2017-09-28 13:20:32 -07:00
Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
2019-04-03 06:26:14 +02:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
leds: triggers: let struct led_trigger::activate() return an error code
2018-07-05 23:21:10 +02:00
Bluetooth: Add combined LED trigger for controller power
2016-09-19 20:19:34 +02:00
Bluetooth: make baswap src const
2017-09-01 22:49:47 +02:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00
networking: make skb_push & __skb_push return void pointers
2017-06-16 11:48:40 -04:00
Bluetooth: Add generic mgmt helper API
2015-03-17 18:03:08 +01:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
Bluetooth: Fix compiler warning with selftest duration calculation
2017-10-06 21:49:13 +03:00
Bluetooth: Add support for self testing framework
2014-12-30 08:53:55 +02:00
Bluetooth: Fix debugfs NULL pointer dereference
2019-04-20 09:16:01 +02:00
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00
c6d1f9b4b2