Bluetooth: hci_sock: Fix possible OOB write in create_monitor_event
Status from this message: Thank you, applied.
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/4 | string.h: add memcpy_and_pad()include/ | +29 | 0 replies | |
| 2/4 | string.h: un-fortify memcpy_and_padinclude/ | +2 | 0 replies | |
| 3/4 | string: uninline memcpy_and_padinclude/ lib/ | +22 | 0 replies | |
| 4/4 | Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX namenet/ | +2 | 1 reply |
Reviews trailers per patch
3 of 4 patches have a Reviewed-by or Acked-by.
| Patch | Sagi Grimberg | Arnd Bergmann | Geert Uytterhoeven | Andy Shevchenko |
|---|---|---|---|---|
| 1/4 | R-b | |||
| 2/4 | A-b | |||
| 3/4 | R-b | A-b | ||
| 4/4 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 4 reviewers.
Cover letter [PATCH 4.4 0/4] Bluetooth: hci_sock: Fix possible OOB write in create_monitor_event
From: Alexander Grund <[email protected]>
This basically fixes the memcpy(dst, src, strlen(src)) where dst is a fixed size array and hence the copy can overflow it.
The changes to string[.h] introduce the required function.
The first commit (initially introducing it) uses some fortification checks & macros not available in 4.4 which I kept in as the get removed in the very next commit.
I also included the fixup commit moving it out of the header although I'm not sure this is strictly required in 4.4. But it doesn't hurt either.
Guenter Roeck (1):
string: uninline memcpy_and_pad
Kees Cook (1):
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX
name
Martin Wilck (2):
string.h: add memcpy_and_pad()
string.h: un-fortify memcpy_and_pad
include/linux/string.h | 3 +++ lib/string_helpers.c | 20 ++++++++++++++++++++ net/bluetooth/hci_sock.c | 3 ++- 3 files changed, 25 insertions(+), 1 deletion(-)
Signature · 1 line
2.40.1