apfs/linux-apfs
0
0
Fork 0
mirror of https://github.com/linux-apfs/linux-apfs.git synced 2026-05-01 15:00:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: Fix potential bad memory access with sysfs files

Browse Source 
When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.

Based on initial patches from Neil Brown and Linus Torvalds

Reported-by: Neil Brown <neilb@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Marcel Holtmann
2010-03-15 14:12:58 -07:00
parent af98441397
commit 101545f6fe
4 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/sco.c
+10 -1
View File
@@ -960,13 +960,22 @@ static ssize_t sco_sysfs_show(struct class *dev,
struct sock *sk;
struct hlist_node *node;
char *str = buf;
int size = PAGE_SIZE;
read_lock_bh(&sco_sk_list.lock);
sk_for_each(sk, node, &sco_sk_list.head) {
str += sprintf(str, "%s %s %d\n",
int len;
len = snprintf(str, size, "%s %s %d\n",
batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
sk->sk_state);
size -= len;
if (size <= 0)
break;
str += len;
}
read_unlock_bh(&sco_sk_list.lock);