Andrei Emeltchenko fc4da4ab6e Bluetooth: Fix kernel crash on L2CAP stress tests ... commit c2c77ec83b upstream. Added very simple check that req buffer has enough space to fit configuration parameters. Shall be enough to reject packets with configuration size more than req buffer. Crash trace below [ 6069.659393] Unable to handle kernel paging request at virtual address 02000205 [ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT ... [ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap] [ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap] ... [ 6070.030303] Backtrace: [ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from [<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap]) [ 6070.043823] r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200 [ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from [<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap]) [ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from [<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth]) [ 6070.072631] r6:dc647700 r5:00000001 r4:df2ab740 [ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from [<c006b9fc>] (tasklet_action+0x78/0xd8) [ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>] Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Acked-by: Gustavo F. Padovan <gustavo@padovan.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2010-04-01 15:58:55 -07:00
..
bnep	net: Add DEVTYPE support for Ethernet based devices	2009-09-11 12:54:55 -07:00
cmtp	isdn: rename capi_ctr_reseted() to capi_ctr_down()	2009-06-08 00:45:50 -07:00
hidp	HID: consolidate connect and disconnect into core code	2009-09-17 15:15:11 +02:00
rfcomm	Bluetooth: Fix potential bad memory access with sysfs files	2010-04-01 15:58:54 -07:00
af_bluetooth.c	net: mark read-only arrays as const	2009-08-05 10:42:58 -07:00
hci_conn.c	Bluetooth: Set general bonding security for ACL by default	2009-11-16 01:30:28 +01:00
hci_core.c	Bluetooth: Convert hdev->req_lock to a mutex	2009-08-22 14:35:02 -07:00
hci_event.c	Bluetooth: Add extra device reference counting for connections	2009-08-22 14:19:26 -07:00
hci_sock.c	net: Make setsockopt() optlen be unsigned.	2009-09-30 16:12:20 -07:00
hci_sysfs.c	bluetooth: scheduling while atomic bug fix	2009-10-19 19:36:45 -07:00
Kconfig	Bluetooth: Add missing selection of CONFIG_CRC16 for L2CAP layer	2009-08-24 16:34:35 -07:00
l2cap.c	Bluetooth: Fix kernel crash on L2CAP stress tests	2010-04-01 15:58:55 -07:00
lib.c	[NET] BLUETOOTH: Fix whitespace errors.	2007-02-10 23:19:20 -08:00
Makefile
sco.c	Bluetooth: Fix potential bad memory access with sysfs files	2010-04-01 15:58:54 -07:00