David Herrmann 1528eb776d Bluetooth: hidp: verify l2cap sockets ... commit b3916db32c upstream. We need to verify that the given sockets actually are l2cap sockets. If they aren't, we are not supposed to access bt_sk(sock) and we shouldn't start the session if the offsets turn out to be valid local BT addresses. That is, if someone passes a TCP socket to HIDCONNADD, then we access some random offset in the TCP socket (which isn't even guaranteed to be valid). Fix this by checking that the socket is an l2cap socket. Change-Id: I401bca741588b34876a1c835d8d4567852b4ec75 Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		2018-01-13 17:14:28 +03:00
..
9p
bluetooth	Bluetooth: hidp: verify l2cap sockets	2018-01-13 17:14:28 +03:00
caif
irda
iucv	af_iucv: add shutdown for HS transport	2012-03-07 22:52:24 -08:00
netfilter	netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len	2016-10-29 23:12:10 +08:00
netns	net: support marking accepting TCP sockets	2014-05-12 22:43:02 -07:00
nfc	NFC: NCI code identation fixes	2012-03-06 15:16:25 -05:00
phonet
sctp	sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING	2016-10-26 23:15:35 +08:00
tc_act
act_api.h
activity_stats.h	net: activity_stats: Add statistics for network transmission activity	2012-04-09 13:57:50 -07:00
addrconf.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
ah.h
arp.h	ipv4: Eliminate spurious argument to __ipv4_neigh_lookup	2012-02-15 17:48:35 -05:00
atmclip.h
ax25.h
ax88796.h
cfg80211-wext.h
cfg80211.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
checksum.h
cipso_ipv4.h	net: fix cipso packet validation when !NETLABEL	2013-11-04 04:23:41 -08:00
cls_cgroup.h
compat.h	net: get rid of some pointless casts to sockaddr	2012-03-11 19:11:22 -07:00
datalink.h
dcbevent.h
dcbnl.h	net: dcb: getnumtcs()/setnumtcs() should return an int	2012-03-02 18:16:49 -08:00
dn.h	decnet: net/dn.h needs net/flow.h	2012-02-15 16:37:44 -05:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dsa.h
dsfield.h
dst.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
dst_ops.h
esp.h
ethoc.h
fib_rules.h	net: core: add UID to flows, rules, and routes	2017-09-01 13:38:07 +03:00
flow.h	net: core: add UID to flows, rules, and routes	2017-09-01 13:38:07 +03:00
flow_keys.h
garp.h
gen_stats.h
genetlink.h
gre.h
icmp.h
ieee80211_radiotap.h
ieee802154.h
ieee802154_netdev.h
if_inet6.h
inet6_connection_sock.h
inet6_hashtables.h	ipv6: use a stronger hash for tcp	2013-09-25 17:01:33 +00:00
inet_common.h
inet_connection_sock.h	inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock	2013-01-11 09:07:14 -08:00
inet_ecn.h
inet_frag.h	inet: limit length of fragment queue hash table bucket lists	2013-03-28 12:11:54 -07:00
inet_hashtables.h
inet_sock.h	net: support marking accepting TCP sockets	2014-05-12 22:43:02 -07:00
inet_timewait_sock.h
inetpeer.h	inetpeer: get rid of ip_id_count	2014-08-14 08:42:35 +08:00
ip.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
ip6_checksum.h
ip6_fib.h	ipv6: fix handling of blackhole and prohibit routes	2016-10-26 23:15:43 +08:00
ip6_route.h	ipv6: Limit mtu to 65575 bytes	2014-06-07 16:01:59 -07:00
ip6_tunnel.h
ip_fib.h	ipv4: fix definition of FIB_TABLE_HASHSZ	2013-03-28 12:11:53 -07:00
ip_vs.h	ipvs: fix oops on NAT reply in br_nf context	2012-10-21 09:28:00 -07:00
ipcomp.h
ipconfig.h
ipip.h	inetpeer: get rid of ip_id_count	2014-08-14 08:42:35 +08:00
ipv6.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
ipx.h
iw_handler.h
lapb.h
lib80211.h
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
mac80211.h	mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL	2014-06-07 16:02:07 -07:00
mip6.h
mld.h
ndisc.h	ipv6: don't call fib6_run_gc() until routing is ready	2016-10-26 23:15:43 +08:00
neighbour.h	net: Do delayed neigh confirmation.	2017-09-01 13:38:10 +03:00
net_namespace.h	userns: make each net (net_ns) belong to a user_ns	2017-09-01 13:38:07 +03:00
net_ratelimit.h
netdma.h
netevent.h
netlabel.h
netlink.h
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h
p8022.h
ping.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
pkt_cls.h
pkt_sched.h	net: sched: export an api to enable/disable flow on sch	2013-03-07 15:20:04 -08:00
protocol.h
psnap.h
raw.h
rawv6.h
red.h	net_sched: red: Make minor corrections to comments	2012-04-16 23:53:11 -04:00
regulatory.h	regulatory: add NUL to alpha2	2014-12-01 18:02:22 +08:00
request_sock.h
rose.h
route.h	Revert "net: core: Support UID-based routing."	2017-08-27 19:09:20 +03:00
rtnetlink.h	rtnetlink: Fix problem with buffer allocation	2012-02-21 16:56:45 -05:00
sch_generic.h	bonding: Fix corrupted queue_mapping	2012-07-16 09:03:47 -07:00
scm.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
secure_seq.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
slhc_vj.h
snmp.h
sock.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
stp.h
tcp.h	Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1	2017-12-27 17:13:15 +03:00
tcp_memcontrol.h
tcp_states.h
timewait_sock.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
transp_v6.h	net: ipv6: Add IPv6 support to the ping socket.	2013-08-21 13:34:09 +09:00
udp.h	ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data	2013-07-28 16:26:02 -07:00
udplite.h	net: ipv4: Standardize prefixes for message logging	2012-03-12 17:05:21 -07:00
wext.h
wimax.h
wpan-phy.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
x25.h
x25device.h
xfrm.h	xfrm: Workaround incompatibility of ESN and async crypto	2012-10-13 05:38:40 +09:00