Mathias Krause f9432c5ec8 Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
The RFCOMM code fails to initialize the two padding bytes of struct
rfcomm_dev_list_req inserted for alignment before copying it to
userland. Additionally there are two padding bytes in each instance of
struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
dev_num times two bytes uninitialized kernel heap memory.

Allocate the memory using kzalloc() to fix this issue.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-15 21:36:30 -07:00
..
2012-08-15 21:36:30 -07:00
2012-07-10 22:36:17 +02:00
2012-07-19 10:48:00 -07:00
2012-08-14 14:45:07 -07:00
2012-07-19 10:48:00 -07:00
2012-07-16 23:23:52 -07:00
2012-06-15 15:30:15 -07:00
2012-04-15 12:44:40 -04:00
2012-05-17 18:45:20 -04:00
2012-07-23 01:01:44 -07:00