[PATCH] Bluetooth: bnep: Fix endianness in bnep_rx_frame() extension parsing

[Dudu Lu <phx0fer@gmail.com>]

In bnep_rx_frame(), the extension header parsing for
BNEP_FILTER_NET_TYPE_SET and BNEP_FILTER_MULTI_ADDR_SET uses
*(u16 *)(skb->data + 1) to read the 2-byte length field.  This
performs a native-endian read, but the BNEP protocol specifies this
field in big-endian (network byte order).

On little-endian architectures (x86, ARM), the bytes are swapped,
causing the length to be wildly incorrect.  For example, a length
of 3 (0x00 0x03) is read as 768 (0x0300).  This causes either:
- skb_pull failure (length too large) -> frame dropped
- Insufficient pull (length too small) -> frame parsing corruption

The same file correctly uses get_unaligned_be16() for identical
fields in bnep_ctrl_set_netfilter() (line 110) and
bnep_ctrl_set_mcfilter() (line 156), confirming the inconsistency.

Replace *(u16 *)(skb->data + 1) with get_unaligned_be16(skb->data + 1).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
 net/bluetooth/bnep/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index d44987d4515c..2d1cb2061045 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -332,7 +332,7 @@ static int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 		case BNEP_FILTER_MULTI_ADDR_SET:
 		case BNEP_FILTER_NET_TYPE_SET:
 			/* Pull: ctrl type (1 b), len (2 b), data (len bytes) */
-			if (!skb_pull(skb, 3 + *(u16 *)(skb->data + 1) * 2))
+			if (!skb_pull(skb, 3 + get_unaligned_be16(skb->data + 1) * 2))
 				goto badframe;
 			break;
 		default:
-- 
2.39.3 (Apple Git-145)