Pengpeng Hou 8f59d17b18 Bluetooth: RFCOMM: pull credit byte with skb_pull_data() ... rfcomm_recv_data() treats the first payload byte as a credit field when the UIH frame carries PF and credit-based flow control is enabled. After the header has been stripped, the PF/CFC path consumes that byte with a direct skb->data dereference followed by skb_pull(). A malformed short frame can reach this path without a byte available. Use skb_pull_data() so the length check and pull happen together before the returned credit byte is consumed. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-05-06 16:23:20 -04:00
..
core.c	Bluetooth: RFCOMM: pull credit byte with skb_pull_data()	2026-05-06 16:23:20 -04:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
sock.c	net: Convert proto_ops connect() callbacks to use sockaddr_unsized	2025-11-04 19:10:32 -08:00
tty.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00