Bluetooth: L2CAP: validate frame length before control and FCS access

l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read.

There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame.

Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.

---
 net/bluetooth/l2cap_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

index 1156aba4e..40ebabe34 100644
@@ -6683,9 +6683,17 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
 {
 	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
-	u16 len;
+	u16 len, min_len;
 	u8 event;
 
+	min_len = test_bit(FLAG_EXT_CTRL, &chan->flags) ?
+		  L2CAP_EXT_CTRL_SIZE : L2CAP_ENH_CTRL_SIZE;
+	if (chan->fcs == L2CAP_FCS_CRC16)
+		min_len += L2CAP_FCS_SIZE;
+
+	if (skb->len < min_len)
+		goto drop;
+
 	__unpack_control(chan, skb);
 
 	len = skb->len;

2.43.0

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165734/

---Test result---

Test Summary:

CheckPatch                    PASS      0.99 seconds
VerifyFixes                   PASS      0.26 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.35 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      28.81 seconds
CheckAllWarning               PASS      34.80 seconds
CheckSparse                   PASS      47.07 seconds
BuildKernel32                 PASS      30.62 seconds
CheckKernelLLVM               PASS      34.12 seconds
TestRunnerSetup               PASS      779.46 seconds
TestRunner_l2cap-tester       FAIL      9.06 seconds
IncrementalBuild              PASS      28.07 seconds

Details
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No test result found

https://github.com/bluez/bluetooth-next/pull/774

---
Regards,
Linux Bluetooth