linux/net/bluetooth
Andrei Emeltchenko c2c77ec83b Bluetooth: Fix kernel crash on L2CAP stress tests
Added very simple check that req buffer has enough space to
fit configuration parameters. Shall be enough to reject packets
with configuration size more than req buffer.

Crash trace below

[ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
[ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
...
[ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
[ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
...
[ 6070.030303] Backtrace:
[ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
[<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
[ 6070.043823]  r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
[ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
[<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
[ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
[<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth])
[ 6070.072631]  r6:dc647700 r5:00000001 r4:df2ab740
[ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from
[<c006b9fc>] (tasklet_action+0x78/0xd8)
[ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>]

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <gustavo@padovan.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-03-21 05:49:36 +01:00
..
bnep net: use netdev_mc_count and netdev_mc_empty when appropriate 2010-02-12 11:38:58 -08:00
cmtp proc_fops: convert drivers/isdn/ to seq_file 2010-01-14 03:10:54 -08:00
hidp Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2010-02-25 14:42:39 -08:00
rfcomm Bluetooth: Convert debug files to actually use debugfs instead of sysfs 2010-03-21 05:49:35 +01:00
af_bluetooth.c net: pass kern to net_proto_family create function 2009-11-05 22:18:14 -08:00
hci_conn.c Bluetooth: Enter active mode before establishing a SCO link. 2010-02-03 19:10:59 -08:00
hci_core.c Bluetooth: Add controller types for BR/EDR and 802.11 AMP 2010-02-27 14:05:38 +01:00
hci_event.c Bluetooth: Add SCO fallback for unsupported feature error 2010-02-27 14:06:00 +01:00
hci_sock.c Bluetooth: Fix out of scope variable access in hci_sock_cmsg() 2010-02-28 00:47:30 -08:00
hci_sysfs.c Bluetooth: Convert debug files to actually use debugfs instead of sysfs 2010-03-21 05:49:35 +01:00
Kconfig Bluetooth: Add missing selection of CONFIG_CRC16 for L2CAP layer 2009-08-24 16:34:35 -07:00
l2cap.c Bluetooth: Fix kernel crash on L2CAP stress tests 2010-03-21 05:49:36 +01:00
lib.c [NET] BLUETOOTH: Fix whitespace errors. 2007-02-10 23:19:20 -08:00
Makefile
sco.c Bluetooth: Convert debug files to actually use debugfs instead of sysfs 2010-03-21 05:49:35 +01:00