Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-1213-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: =?UTF-8?q?Mariusz=20Koz=C5=82owski?= <mk@lab.zgora.pl>
To: linux-bluetooth@vger.kernel.org
Cc: =?UTF-8?q?Mariusz=20Koz=C5=82owski?= <mk@lab.zgora.pl>
Subject: [PATCH BlueZ] btmon-logger: Fix stack corruption
Date: Sun, 21 Jan 2024 11:03:28 +0100
Message-Id: <20240121100328.1200839-1-mk@lab.zgora.pl>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Version 3 capability masks are 64 bits in size.
---
 tools/btmon-logger.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/btmon-logger.c b/tools/btmon-logger.c
index a770ad575..1f6db3751 100644
--- a/tools/btmon-logger.c
+++ b/tools/btmon-logger.c
@@ -161,14 +161,14 @@ extern int capset(struct __user_cap_header_struct *header,
 static void drop_capabilities(void)
 {
 	struct __user_cap_header_struct header;
-	struct __user_cap_data_struct cap;
+	struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3];
 	unsigned int mask;
 	int err;
 
 	header.version = _LINUX_CAPABILITY_VERSION_3;
 	header.pid = 0;
 
-	err = capget(&header, &cap);
+	err = capget(&header, cap);
 	if (err) {
 		perror("Unable to get current capabilities");
 		return;
@@ -177,11 +177,11 @@ static void drop_capabilities(void)
 	/* not needed anymore since monitor socket is already open */
 	mask = ~CAP_TO_MASK(CAP_NET_RAW);
 
-	cap.effective &= mask;
-	cap.permitted &= mask;
-	cap.inheritable &= mask;
+	cap[0].effective &= mask;
+	cap[0].permitted &= mask;
+	cap[0].inheritable &= mask;
 
-	err = capset(&header, &cap);
+	err = capset(&header, cap);
 	if (err)
 		perror("Failed to set capabilities");
 }
-- 
2.34.1