diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2026-03-13 05:22:39 +0900 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-03-19 14:42:12 -0400 |
| commit | c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 (patch) | |
| tree | b7489ed6c82c4e8c3bb6b3d86b80c83da91b4b96 /drivers/usb/input/git@git.tavy.me:linux.git | |
| parent | 9d87cb22195b2c67405f5485d525190747ad5493 (diff) | |
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using
get_unaligned_le16() without first verifying that skb contains at least
L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads
past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading
the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the
same validation to the Enhanced Credit Based Flow Control data path.
Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/usb/input/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions