* [PATCHv2 2/3] Bluetooth: check for l2cap header in start fragment
@ 2010-09-07 9:12 Emeltchenko Andrei
0 siblings, 0 replies; 2+ messages in thread
From: Emeltchenko Andrei @ 2010-09-07 9:12 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 9fad312..774e134 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -4664,7 +4664,7 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
l2cap_conn_unreliable(conn, ECOMM);
}
- if (skb->len < 2) {
+ if (skb->len < L2CAP_HDR_SIZE) {
BT_ERR("Frame is too short (len %d)", skb->len);
l2cap_conn_unreliable(conn, ECOMM);
goto drop;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCHv2 0/3] Bluetooth: L2CAP robustness fixes
@ 2010-09-07 8:57 Emeltchenko Andrei
2010-09-07 8:57 ` [PATCHv2 2/3] Bluetooth: check for l2cap header in start fragment Emeltchenko Andrei
0 siblings, 1 reply; 2+ messages in thread
From: Emeltchenko Andrei @ 2010-09-07 8:57 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Fixes increase L2CAP robustness to DOS attacks to BT stack.
Andrei Emeltchenko (3):
Bluetooth: fix MTU L2CAP configuration parameter
Bluetooth: check for l2cap header in start fragment
Bluetooth: check L2CAP length in first ACL fragment
net/bluetooth/l2cap.c | 25 +++++++++++++++++++++----
1 files changed, 21 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCHv2 2/3] Bluetooth: check for l2cap header in start fragment
2010-09-07 8:57 [PATCHv2 0/3] Bluetooth: L2CAP robustness fixes Emeltchenko Andrei
@ 2010-09-07 8:57 ` Emeltchenko Andrei
0 siblings, 0 replies; 2+ messages in thread
From: Emeltchenko Andrei @ 2010-09-07 8:57 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 9fad312..774e134 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -4664,7 +4664,7 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
l2cap_conn_unreliable(conn, ECOMM);
}
- if (skb->len < 2) {
+ if (skb->len < L2CAP_HDR_SIZE) {
BT_ERR("Frame is too short (len %d)", skb->len);
l2cap_conn_unreliable(conn, ECOMM);
goto drop;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-09-07 9:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-09-07 9:12 [PATCHv2 2/3] Bluetooth: check for l2cap header in start fragment Emeltchenko Andrei
-- strict thread matches above, loose matches on Subject: below --
2010-09-07 8:57 [PATCHv2 0/3] Bluetooth: L2CAP robustness fixes Emeltchenko Andrei
2010-09-07 8:57 ` [PATCHv2 2/3] Bluetooth: check for l2cap header in start fragment Emeltchenko Andrei
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox