Luiz Augusto von Dentz
ea213d57f6
Bluetooth: bnep: Fix out-of-bound access ...
[ Upstream commit 0f0639b4d6f649338ce29c62da3ec0787fa08cd1 ]
This fixes attempting to access past ethhdr.h_source, although it seems
intentional to copy also the contents of h_proto this triggers
out-of-bound access problems with the likes of static analyzer, so this
instead just copy ETH_ALEN and then proceed to use put_unaligned to copy
h_proto separetely.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-04 13:14:57 +02:00
Bluetooth: bnep: Fix out-of-bound access
2024-09-04 13:14:57 +02:00
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2022-01-27 09:19:29 +01:00
Bluetooth: Fix race condition in hidp_session_thread
2023-04-20 12:07:35 +02:00
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
2024-03-26 18:22:13 -04:00
Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
2022-12-14 11:30:45 +01:00
Bluetooth: Fix not cleanup led when bt_init fails
2022-12-14 11:30:45 +01:00
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
2024-01-25 14:34:26 -08:00
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
2024-07-27 10:38:32 +02:00
Bluetooth: Fix TOCTOU in HCI debugfs implementation
2024-04-13 12:51:33 +02:00
Bluetooth: hci_event: set the conn encrypted before conn establishes
2024-04-13 12:51:33 +02:00
Bluetooth: Fix memory leak in hci_req_sync_complete()
2024-05-02 16:18:28 +02:00
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
2023-10-25 11:53:25 +02:00
Bluetooth: Fix double free in hci_conn_cleanup
2023-11-28 16:50:14 +00:00
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
2024-08-19 05:33:46 +02:00
Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
2024-05-02 16:18:36 +02:00
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
2024-05-17 11:43:53 +02:00
ea213d57f6