Skip to contentSkip to conversation

Bluetooth: check for (harmless) underflow

PATCH In review Dan Carpenter 2 participants 2 messages May 30, 2013 – May 31, 2013

Subsystems (3)
Bluetooth drivers Kernel janitors Bluetooth
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 Bluetooth: check for (harmless) underflow

"len" can be negative here. It's harmless but pretty subtle and scary looking so lets add a check for it.

Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/l2cap_core.c +3 -0
index a1b7a02..438f39e 100644
@@ -4069,6 +4069,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
 	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
 	       result, len);
 
+	if (len < 0)
+		return -EINVAL;
+
 	chan = l2cap_get_chan_by_scid(conn, scid);
 	if (!chan)
 		return 0;
#1 lore raw

Hi Dan,

Quoted 10 lines · Dan Carpenter

"len" can be negative here. It's harmless but pretty subtle and scary looking so lets add a check for it.

Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/l2cap_core.c +0 -0
index a1b7a02..438f39e 100644

net/bluetooth/l2cap_core.c static inline int l2cap_config_rsp(struct l2cap_conn *conn, · line 4077

Quoted 9 lines
net/bluetooth/l2cap_core.c +3 -0
@@ -4069,6 +4069,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
 	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
 	       result, len);
 
+	if (len < 0)
+		return -EINVAL;
+
 	chan = l2cap_get_chan_by_scid(conn, scid);
 	if (!chan)
 		return 0;

We already pushed to bluetooth.git a more comprehensive patch to fix this issue and others over the code. Thanks anyway for sending this.

Gustavo