>From 790f94a74f8214baab44eb346a346640e6335319 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 10 Mar 2014 10:50:10 -0400 Subject: [PATCH 2/3] cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket ... rather than relying on ciptool(8) never passing it anything else. Give it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops, trying to evaluate &l2cap_pi(sock->sk)->chan->dst... Signed-off-by: Al Viro --- net/bluetooth/cmtp/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 67fe5e8..fd57db8 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -333,6 +333,8 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) int i, err; BT_DBG(""); + if (!l2cap_is_socket(sock)) + return -EBADFD; session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL); if (!session) -- 1.7.10.4