LKML Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] Bluetooth: A2MP: Do not set rsp.id to zero
@ 2020-10-18  8:05 Stefan Gottwald
  2020-10-18 16:25 ` Stefan Gottwald
  0 siblings, 1 reply; 2+ messages in thread
From: Stefan Gottwald @ 2020-10-18  8:05 UTC (permalink / raw)
  To: marcel
  Cc: gregkh, gottwald, gotti79, Johan Hedberg, David S. Miller,
	Jakub Kicinski, linux-bluetooth, netdev, linux-kernel

Due to security reasons the rsp struct is not zerod out in one case this will
also zero out the former set rsp.id which seems to be wrong.

Signed-off-by: Stefan Gottwald <gotti79@posteo.net>
---
 net/bluetooth/a2mp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index da7fd7c..7a1e0b7 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -381,10 +381,11 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
 	hdev = hci_dev_get(req->id);
 	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
 		struct a2mp_amp_assoc_rsp rsp;
-		rsp.id = req->id;
 
 		memset(&rsp, 0, sizeof(rsp));
 
+		rsp.id = req->id;
+
 		if (tmp) {
 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
 			amp_mgr_put(tmp);
-- 
2.7.4


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] Bluetooth: A2MP: Do not set rsp.id to zero
  2020-10-18  8:05 [PATCH] Bluetooth: A2MP: Do not set rsp.id to zero Stefan Gottwald
@ 2020-10-18 16:25 ` Stefan Gottwald
  0 siblings, 0 replies; 2+ messages in thread
From: Stefan Gottwald @ 2020-10-18 16:25 UTC (permalink / raw)
  To: marcel
  Cc: gregkh, gottwald, Johan Hedberg, David S. Miller, Jakub Kicinski,
	linux-bluetooth, netdev, linux-kernel

Am Sonntag, den 18.10.2020, 10:05 +0200 schrieb Stefan Gottwald:
> Due to security reasons the rsp struct is not zerod out in one case this will
> also zero out the former set rsp.id which seems to be wrong.
> 
> Signed-off-by: Stefan Gottwald <gotti79@posteo.net>
> ---
>  net/bluetooth/a2mp.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
> index da7fd7c..7a1e0b7 100644
> --- a/net/bluetooth/a2mp.c
> +++ b/net/bluetooth/a2mp.c
> @@ -381,10 +381,11 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
>  	hdev = hci_dev_get(req->id);
>  	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
>  		struct a2mp_amp_assoc_rsp rsp;
> -		rsp.id = req->id;
>  
>  		memset(&rsp, 0, sizeof(rsp));
>  
> +		rsp.id = req->id;
> +
>  		if (tmp) {
>  			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
>  			amp_mgr_put(tmp);

As it seems I'm too slow there is already a fix from the author of the initial patch.

https://lore.kernel.org/linux-bluetooth/20201016180956.707681-2-luiz.dentz@gmail.com/

There is a additional patch in this series which might also be a important fix

https://lore.kernel.org/linux-bluetooth/20201016180956.707681-1-luiz.dentz@gmail.com/

Thanks to a LWN member pointing this out to me.


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-18  8:05 [PATCH] Bluetooth: A2MP: Do not set rsp.id to zero Stefan Gottwald
2020-10-18 16:25 ` Stefan Gottwald

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git