From patchwork Fri Feb 11 20:35:18 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brad Figg X-Patchwork-Id: 82825 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id F1F61B719A for ; Sat, 12 Feb 2011 07:39:16 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pnzlj-00053I-Hq; Fri, 11 Feb 2011 20:39:07 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pnzlf-00052j-NX for kernel-team@lists.ubuntu.com; Fri, 11 Feb 2011 20:39:03 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1Pnzlf-0006ih-M3 for ; Fri, 11 Feb 2011 20:39:03 +0000 Received: from pool-98-108-155-157.ptldor.fios.verizon.net ([98.108.155.157] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Pnzlf-0006Ng-AZ for kernel-team@lists.ubuntu.com; Fri, 11 Feb 2011 20:39:03 +0000 From: Brad Figg To: kernel-team@lists.ubuntu.com Subject: [Dapper] [CVE-2010-4242] [PATCH 1/1] bluetooth: Fix missing NULL check, CVE-2010-4242 Date: Fri, 11 Feb 2011 12:35:18 -0800 Message-Id: <1297456520-4811-2-git-send-email-brad.figg@canonical.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1297456520-4811-1-git-send-email-brad.figg@canonical.com> References: <1297456520-4811-1-git-send-email-brad.figg@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Alan Cox CVE-2010-4242 BugLink: http://bugs.launchpad.net/bugs/714846 Fortunately this is only exploitable on very unusual hardware. [Reported a while ago but nothing happened so just fixing it] Signed-off-by: Alan Cox Cc: stable@kernel.org Signed-off-by: Linus Torvalds (backported from commit c19483cc5e56ac5e22dd19cf25ba210ab1537773) Signed-off-by: Brad Figg --- drivers/bluetooth/hci_ldisc.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 573ff6c..68a4649 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -269,9 +269,16 @@ static int hci_uart_tty_open(struct tty_struct *tty) BT_DBG("tty %p", tty); + /* FIXME: This btw is bogus, nothing requires the old ldisc to clear + the pointer */ if (hu) return -EEXIST; + /* Error if the tty has no write op instead of leaving an exploitable + hole */ + if (tty->driver->write == NULL) + return -EOPNOTSUPP; + if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) { BT_ERR("Can't allocate controll structure"); return -ENFILE;