diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2010-03-15 14:12:58 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-04-01 16:02:13 -0700 |
| commit | a318674438c789f5bf46a91cf24b5988b2091f16 (patch) | |
| tree | 8b06bfb539b09d4778622ff2c65af0e1881d53cb /net/bluetooth/sco.c | |
| parent | 3ecee16aa4617db7cb756ad01526d395dc86d95f (diff) | |
Bluetooth: Fix potential bad memory access with sysfs files
commit 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 upstream.
When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.
Based on initial patches from Neil Brown and Linus Torvalds
Reported-by: Neil Brown <neilb@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/bluetooth/sco.c')
| -rw-r--r-- | net/bluetooth/sco.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index dd8f6ec57dce..66cab63e76e3 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -958,13 +958,22 @@ static ssize_t sco_sysfs_show(struct class *dev, char *buf) struct sock *sk; struct hlist_node *node; char *str = buf; + int size = PAGE_SIZE; read_lock_bh(&sco_sk_list.lock); sk_for_each(sk, node, &sco_sk_list.head) { - str += sprintf(str, "%s %s %d\n", + int len; + + len = snprintf(str, size, "%s %s %d\n", batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst), sk->sk_state); + + size -= len; + if (size <= 0) + break; + + str += len; } read_unlock_bh(&sco_sk_list.lock); |