projects
/
platform
/
kernel
/
linux-amlogic.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
aea7791
)
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
author
Peilin Ye
<yepeilin.cs@gmail.com>
Fri, 10 Jul 2020 21:39:18 +0000
(17:39 -0400)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Fri, 21 Aug 2020 09:01:53 +0000
(11:01 +0200)
commit
75bbd2ea50ba1c5d9da878a17e92eac02fe0fd3a
upstream.
Check `num_rsp` before using it as for-loop counter.
Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/bluetooth/hci_event.c
patch
|
blob
|
history
diff --git
a/net/bluetooth/hci_event.c
b/net/bluetooth/hci_event.c
index
0ce196b
..
29bb402
100644
(file)
--- a/
net/bluetooth/hci_event.c
+++ b/
net/bluetooth/hci_event.c
@@
-2094,7
+2094,7
@@
static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
- if (!num_rsp)
+ if (!num_rsp
|| skb->len < num_rsp * sizeof(*info) + 1
)
return;
if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))