Jiale Yao b230e5bf50 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame ... rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b828c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS). Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-07-28 15:01:31 -04:00
..
core.c	Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame	2026-07-28 15:01:31 -04:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
sock.c	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
tty.c	Bluetooth: RFCOMM: Fix session UAF in set_termios	2026-07-20 17:41:07 -04:00