Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-06 05:02:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bluetooth: Check address length before reading address field

Browse Source 
KMSAN will complain if valid address length passed to bind() is shorter
than sizeof(struct sockaddr_sco) bytes.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Tetsuo Handa 2019-04-12 19:54:33 +09:00 committed by David S. Miller
parent a9107a14a9
commit bd7d46ddca
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/sco.c
View File

@ -523,12 +523,12 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
int err = 0; int err = 0;
BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
if (!addr || addr_len < sizeof(struct sockaddr_sco) || if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
addr->sa_family != AF_BLUETOOTH) addr->sa_family != AF_BLUETOOTH)
return -EINVAL; return -EINVAL;
BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
lock_sock(sk); lock_sock(sk);
if (sk->sk_state != BT_OPEN) { if (sk->sk_state != BT_OPEN) {