Re: [PATCH 2/2] Bluetooth: check the buffer size for some messages before parsing

Hi Greg, The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from userspace so their structure sizes need to be checked before parsing them. >>> >>> this message is confusing me. How can these be send from userspace? >> >> So claimed the original reporter. You have the inf

Re: [PATCH 2/2] Bluetooth: check the buffer size for some messages before parsing

Hi Greg, >>> The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from >>> userspace so their structure sizes need to be checked before parsing >>> them. >> >> this message is confusing me. How can these be send from userspace? > > So claimed the original reporter. You have the informatio

Re: [PATCH 2/2] Bluetooth: check the buffer size for some messages before parsing

On Fri, Jan 18, 2019 at 10:37:25AM +0100, Marcel Holtmann wrote: > Hi Greg, > > > The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from > > userspace so their structure sizes need to be checked before parsing > > them. > > this message is confusing me. How can these be send from userspa

Re: [PATCH 2/2] Bluetooth: check the buffer size for some messages before parsing

Hi Greg, > The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from > userspace so their structure sizes need to be checked before parsing > them. this message is confusing me. How can these be send from userspace? > > Based on a patch from Ran Menscher. > > Reported-by: Ran Menscher >

Re: [PATCH 2/2] Bluetooth: check the buffer size for some messages before parsing

On Thu, Jan 10, 2019 at 07:29:17AM +0100, Greg Kroah-Hartman wrote: > The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from > userspace so their structure sizes need to be checked before parsing > them. > > Based on a patch from Ran Menscher. Ran, can you verify if these two patches sol