linux/net/bluetooth
Ben Seri 8a7b081660 Bluetooth: Properly check L2CAP config option output buffer length
commit e860d2c904 upstream.

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-10-12 15:28:11 +01:00
..
bnep net/*: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
cmtp Bluetooth: Access CMTP session addresses through L2CAP channel 2013-10-13 20:00:30 +03:00
hidp Bluetooth: hidp: fix device disconnect on idle timeout 2015-12-13 17:48:51 +00:00
rfcomm Bluetooth: Fix potential NULL dereference in RFCOMM bind callback 2016-11-20 01:17:37 +00:00
6lowpan.c Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2014-06-05 14:10:07 -04:00
6lowpan.h Bluetooth: make bluetooth 6lowpan as an option 2014-03-11 07:54:55 -07:00
a2mp.c Bluetooth: Convert uses of __constant_<foo> to <foo> 2014-03-12 11:10:17 -07:00
a2mp.h Bluetooth: Move a2mp.h header file into net/bluetooth/ 2013-10-11 00:10:05 +02:00
af_bluetooth.c Bluetooth: Increase minor version of core module 2014-02-21 06:21:55 +02:00
amp.c Bluetooth: Remove l2cap_conn->dst usage from AMP manager 2013-10-13 17:43:32 +03:00
amp.h Bluetooth: Move amp.h header file into net/bluetooth/ 2013-10-11 00:10:03 +02:00
hci_conn.c Bluetooth: Fix LE connection timeout deadlock 2015-01-05 13:33:42 +00:00
hci_core.c Bluetooth: Make SMP context private to smp.c 2014-05-20 08:44:11 -07:00
hci_event.c Bluetooth: Fix using uninitialized variable when pairing 2014-09-17 09:22:14 -07:00
hci_sock.c Bluetooth: Fix user channel for 32bit userspace on 64bit kernel 2017-08-26 02:14:42 +01:00
hci_sysfs.c Bluetooth: Convert to use ATTRIBUTE_GROUPS macro 2014-02-13 09:51:34 +02:00
Kconfig Bluetooth: make sure 6LOWPAN_IPHC is built-in if needed 2014-03-13 07:05:10 -07:00
l2cap_core.c Bluetooth: Properly check L2CAP config option output buffer length 2017-10-12 15:28:11 +01:00
l2cap_sock.c Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU 2016-11-20 01:16:52 +00:00
lib.c Bluetooth: Add error mapping for Directed Advertising Timeout 2014-03-26 09:31:36 -07:00
Makefile Bluetooth: make bluetooth 6lowpan as an option 2014-03-11 07:54:55 -07:00
mgmt.c Bluetooth: Fix locking of hdev when calling into SMP code 2014-06-13 13:32:29 +02:00
sco.c bluetooth: Validate socket address length in sco_sock_bind(). 2016-01-04 17:20:47 +00:00
smp.c Bluetooth: use constant time memory comparison for secret values 2017-10-12 15:27:47 +01:00
smp.h Bluetooth: Make SMP context private to smp.c 2014-05-20 08:44:11 -07:00