From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752098AbcAFEge (ORCPT ); Tue, 5 Jan 2016 23:36:34 -0500 Received: from mail-yk0-f180.google.com ([209.85.160.180]:34768 "EHLO mail-yk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751969AbcAFEgc (ORCPT ); Tue, 5 Jan 2016 23:36:32 -0500 From: Insu Yun To: marcel@holtmann.org, gustavo@padovan.org, johan.hedberg@gmail.com, davem@davemloft.net, peter@hurleysoftware.com, jaganath.k@samsung.com, ying.xue@windriver.com, ebiederm@xmission.com, linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: taesoo@gatech.edu, yeongjin.jang@gatech.edu, insu@gatech.edu, changwoo@gatech.edu, Insu Yun Subject: [PATCH] rfcomm: fix information leak in rfcomm_sock_bind Date: Tue, 5 Jan 2016 23:36:33 -0500 Message-Id: <1452054993-76111-1-git-send-email-wuninsu@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org if addr_len < sizeof(sa), sa.rc_bdaddr(4bytes) can be leaked by using rfcomm_sock_getname() Signed-off-by: Insu Yun --- net/bluetooth/rfcomm/sock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 7511df7..d61dfdc 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -336,14 +336,15 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr { struct sockaddr_rc sa; struct sock *sk = sock->sk; - int len, err = 0; + int err = 0; if (!addr || addr->sa_family != AF_BLUETOOTH) return -EINVAL; - memset(&sa, 0, sizeof(sa)); - len = min_t(unsigned int, sizeof(sa), addr_len); - memcpy(&sa, addr, len); + if (addr_len != sizeof(sa)) + return -EINVAL; + + memcpy(&sa, addr, addr_len); BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); -- 1.9.1