Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757237Ab0KSVpU (ORCPT ); Fri, 19 Nov 2010 16:45:20 -0500 Received: from kroah.org ([198.145.64.141]:51693 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757161Ab0KSVpR (ORCPT ); Fri, 19 Nov 2010 16:45:17 -0500 X-Mailbox-Line: From gregkh@clark.site Fri Nov 19 13:44:09 2010 Message-Id: <20101119214409.927551123@clark.site> User-Agent: quilt/0.48-11.2 Date: Fri, 19 Nov 2010 13:42:46 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Alan Cox Subject: [06/45] bluetooth: Fix missing NULL check In-Reply-To: <20101119214439.GA26350@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1371 Lines: 46 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Alan Cox commit c19483cc5e56ac5e22dd19cf25ba210ab1537773 upstream. Fortunately this is only exploitable on very unusual hardware. [Reported a while ago but nothing happened so just fixing it] Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/bluetooth/hci_ldisc.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -258,9 +258,16 @@ static int hci_uart_tty_open(struct tty_ BT_DBG("tty %p", tty); + /* FIXME: This btw is bogus, nothing requires the old ldisc to clear + the pointer */ if (hu) return -EEXIST; + /* Error if the tty has no write op instead of leaving an exploitable + hole */ + if (tty->ops->write == NULL) + return -EOPNOTSUPP; + if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) { BT_ERR("Can't allocate control structure"); return -ENFILE; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/