korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2025-01-22 22:04:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()

Browse Source 
[ Upstream commit 2b70d4f9b2 ]

The "opt" variable is a u32, but on some paths only the top bytes
were initialized and the others contained random stack data.

Fixes: a7b75c5a8c ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2022-01-07 10:16:44 +03:00 committed by Greg Kroah-Hartman
parent b918c668d2
commit abe4b2c214
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/bluetooth/l2cap_sock.c
View File

@ -903,6 +903,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
struct l2cap_conn *conn; struct l2cap_conn *conn;
int len, err = 0; int len, err = 0;
u32 opt; u32 opt;
u16 mtu;
u8 mode;
BT_DBG("sk %p", sk); BT_DBG("sk %p", sk);
@ -1085,16 +1087,16 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u16))) { if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
err = -EFAULT; err = -EFAULT;
break; break;
} }
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
sk->sk_state == BT_CONNECTED) sk->sk_state == BT_CONNECTED)
err = l2cap_chan_reconfigure(chan, opt); err = l2cap_chan_reconfigure(chan, mtu);
else else
chan->imtu = opt; chan->imtu = mtu;
break; break;
@ -1116,14 +1118,14 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break; break;
} }
if (copy_from_sockptr(&opt, optval, sizeof(u8))) { if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
err = -EFAULT; err = -EFAULT;
break; break;
} }
BT_DBG("opt %u", opt); BT_DBG("mode %u", mode);
err = l2cap_set_mode(chan, opt); err = l2cap_set_mode(chan, mode);
if (err) if (err)
break; break;