Commit b6a2bf43 authored by Christian Eggers's avatar Christian Eggers Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU 



Core 6.0, Vol 3, Part A, 3.4.3:
"... If the sum of the payload sizes for the K-frames exceeds the
specified SDU length, the receiver shall disconnect the channel."

This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
0x0027 -V le_public').

Fixes: aac23bf6 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: default avatarChristian Eggers <ceggers@arri.de>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent e1d9a668

net/bluetooth/l2cap_core.c

+1 −0
Original line number Diff line number Diff line
@@ -6729,6 +6729,7 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 


	if (chan->sdu->len + skb->len > chan->sdu_len) {

		BT_ERR("Too much LE L2CAP data received");

		l2cap_send_disconn_req(chan, ECONNRESET);

		err = -EINVAL;

		goto failed;

	}