Commit c65bd945 authored by Hyunwoo Kim's avatar Hyunwoo Kim Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() 



l2cap_ecred_data_rcv() reads the SDU length field from skb->data using
get_unaligned_le16() without first verifying that skb contains at least
L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads
past the valid data in the skb.

The ERTM reassembly path correctly calls pskb_may_pull() before reading
the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the
same validation to the Enhanced Credit Based Flow Control data path.

Fixes: aac23bf6 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: default avatarHyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 9d87cb22

net/bluetooth/l2cap_core.c

+5 −0
Original line number Diff line number Diff line
@@ -6690,6 +6690,11 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 
	if (!chan->sdu) {

		u16 sdu_len;



		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {

			err = -EINVAL;

			goto failed;

		}



		sdu_len = get_unaligned_le16(skb->data);

		skb_pull(skb, L2CAP_SDULEN_SIZE);