Commit 96a3398b authored by Frédéric Danis's avatar Frédéric Danis Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: L2CAP: Fix possible multiple reject send 



In case of an incomplete command or a command with a null identifier 2
reject packets will be sent, one with the identifier and one with 0.
Consuming the data of the command will prevent it.
This allows to send a reject packet for each corrupted command in a
multi-command packet.

Signed-off-by: default avatarFrédéric Danis <frederic.danis@collabora.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent d4b70ba1

net/bluetooth/l2cap_core.c

+2 −1
Original line number Diff line number Diff line
@@ -6526,7 +6526,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, 
		if (len > skb->len || !cmd->ident) {

			BT_DBG("corrupted command");

			l2cap_sig_send_rej(conn, cmd->ident);

			break;

			skb_pull(skb, len > skb->len ? skb->len : len);

			continue;

		}



		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);