Bluetooth: bnep: fix buffer overflow
commite826581a58ce64a98332b840354f4f18348a71c7
authorVasiliy Kulikov <segoon@openwall.com>
Mon, 14 Feb 2011 10:54:31 +0000 (14 13:54 +0300)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 14 Apr 2011 23:53:33 +0000 (14 16:53 -0700)
tree528e1b52403abaa5ea62a02e15a37d5bf554ee17
parenta04a632411960cb96d5b9defa571eb8128999f11
Bluetooth: bnep: fix buffer overflow

commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.

Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/bluetooth/bnep/sock.c