Bluetooth: sco: fix information leak to userspace
authorVasiliy Kulikov <segoon@openwall.com>
Mon, 14 Feb 2011 10:54:26 +0000 (13:54 +0300)
committerBrad Figg <brad.figg@canonical.com>
Wed, 27 Apr 2011 18:41:13 +0000 (11:41 -0700)
commitd7d07bff70c0034785594e2a4cbb3ce354aa9c42
treebf7f896f13f27b71fa43bb878d78bc8a041a0901
parentaebac8c1ad3e526360845cc56a6bfea30c6ecbf1
Bluetooth: sco: fix information leak to userspace

BugLink: http://bugs.launchpad.net/bugs/761134

commit c4c896e1471aec3b004a693c689f60be3b17ac86 upstream.

struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
net/bluetooth/sco.c