• Mathias Krause's avatar
    Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) · f9432c5e
    Mathias Krause authored
    The RFCOMM code fails to initialize the two padding bytes of struct
    rfcomm_dev_list_req inserted for alignment before copying it to
    userland. Additionally there are two padding bytes in each instance of
    struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
    dev_num times two bytes uninitialized kernel heap memory.
    
    Allocate the memory using kzalloc() to fix this issue.
    Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Cc: Gustavo Padovan <gustavo@padovan.org>
    Cc: Johan Hedberg <johan.hedberg@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    f9432c5e
tty.c 26.5 KB