[linux] 01/01: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (CVE-2015-8956)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit 9217c0ac519f0af6074770acc76b361e58a00ecc
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Tue Oct 18 07:32:44 2016 +0200

    Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (CVE-2015-8956)
---
 debian/changelog                                   |  2 +
 ...ix-potential-null-dereference-in-rfcomm-b.patch | 62 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 65 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 26455d1..903375c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ linux (3.16.36-1+deb8u2) UNRELEASED; urgency=medium
 
   * KEYS: Fix short sprintf buffer in /proc/keys show function (CVE-2016-7042)
   * scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (CVE-2016-7425)
+  * Bluetooth: Fix potential NULL dereference in RFCOMM bind callback
+    (CVE-2015-8956)
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Tue, 18 Oct 2016 06:39:49 +0200
 
diff --git a/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch b/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
new file mode 100644
index 0000000..34b2051
--- /dev/null
+++ b/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
@@ -0,0 +1,62 @@
+From: Jaganath Kanakkassery <jaganath.k at samsung.com>
+Date: Thu, 14 May 2015 12:58:08 +0530
+Subject: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback
+Origin: https://git.kernel.org/linus/951b6a0717db97ce420547222647bcc40bf1eacd
+
+addr can be NULL and it should not be dereferenced before NULL checking.
+
+Signed-off-by: Jaganath Kanakkassery <jaganath.k at samsung.com>
+Signed-off-by: Marcel Holtmann <marcel at holtmann.org>
+---
+ net/bluetooth/rfcomm/sock.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index b2338e9..7511df7 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -334,16 +334,19 @@ static int rfcomm_sock_create(struct net *net, struct socket *sock,
+ 
+ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ {
+-	struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
++	struct sockaddr_rc sa;
+ 	struct sock *sk = sock->sk;
+-	int chan = sa->rc_channel;
+-	int err = 0;
+-
+-	BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
++	int len, err = 0;
+ 
+ 	if (!addr || addr->sa_family != AF_BLUETOOTH)
+ 		return -EINVAL;
+ 
++	memset(&sa, 0, sizeof(sa));
++	len = min_t(unsigned int, sizeof(sa), addr_len);
++	memcpy(&sa, addr, len);
++
++	BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
++
+ 	lock_sock(sk);
+ 
+ 	if (sk->sk_state != BT_OPEN) {
+@@ -358,12 +361,13 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
+ 
+ 	write_lock(&rfcomm_sk_list.lock);
+ 
+-	if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
++	if (sa.rc_channel &&
++	    __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
+ 		err = -EADDRINUSE;
+ 	} else {
+ 		/* Save source address */
+-		bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
+-		rfcomm_pi(sk)->channel = chan;
++		bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
++		rfcomm_pi(sk)->channel = sa.rc_channel;
+ 		sk->sk_state = BT_BOUND;
+ 	}
+ 
+-- 
+2.9.3
+
diff --git a/debian/patches/series b/debian/patches/series
index 6c972f5..6562c67 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -679,6 +679,7 @@ bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
 bugfix/all/aacraid-Check-size-values-after-double-fetch-from-us.patch
 bugfix/all/KEYS-Fix-short-sprintf-buffer-in-proc-keys-show-func.patch
 bugfix/all/scsi-arcmsr-Buffer-overflow-in-arcmsr_iop_message_xf.patch
+bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git