github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.2-rc1
linux/net/bluetooth
History
Samuel Moelius a40a5f9225 Bluetooth: L2CAP: validate connectionless PSM length 
Connectionless L2CAP frames carry a two-byte PSM at the start of the
payload.  l2cap_recv_frame() currently reads that PSM unconditionally
after validating only the outer L2CAP length.

A malformed connectionless frame with a zero- or one-byte payload can
therefore make the parser read beyond the advertised skb payload and use
tailroom bytes as part of the PSM.  A VHCI-backed QEMU reproducer
injected a one-byte connectionless payload and reached the unchecked
read.

Reject connectionless frames that cannot contain the PSM before reading
or pulling it.  This preserves all valid connectionless frames while
dropping only structurally incomplete packets.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-06-11 14:24:41 -04:00
..
bnep Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hidp Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
rfcomm Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
6lowpan.c Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister 2026-06-11 14:24:37 -04:00
af_bluetooth.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
aosp.c Bluetooth: aosp: Fix typo in comment 2025-07-23 10:30:18 -04:00
aosp.h Bluetooth: aosp: Support AOSP Bluetooth Quality Report 2021-11-02 19:37:52 +01:00
coredump.c Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv 2025-07-23 10:33:57 -04:00
ecdh_helper.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
ecdh_helper.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
eir.c Bluetooth: eir: Fix stack OOB write when prepending the Flags AD 2026-06-11 14:24:40 -04:00
eir.h Bluetooth: eir: Fix possible crashes on eir_create_adv_data 2025-06-11 16:29:22 -04:00
hci_codec.c Bluetooth: hci: validate codec capability element length 2026-06-11 14:24:41 -04:00
hci_codec.h Bluetooth: Add support for Read Local Supported Codecs V2 2021-09-07 14:09:18 -07:00
hci_conn.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_core.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_debugfs.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_debugfs.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_drv.c Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
hci_event.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_sock.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_sync.c Bluetooth: hci_sync: Add support for HCI_LE_Set_Host_Feature [v2] 2026-06-11 14:24:39 -04:00
hci_sysfs.c Bluetooth: fix memory leak in error path of hci_alloc_dev() 2026-06-03 11:22:28 -04:00
iso.c Bluetooth: ISO: convert to getsockopt_iter 2026-06-11 14:24:38 -04:00
Kconfig Bluetooth: SMP: Use AES-CMAC library API 2026-06-11 14:24:38 -04:00
l2cap_core.c Bluetooth: L2CAP: validate connectionless PSM length 2026-06-11 14:24:41 -04:00
l2cap_sock.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
leds.c Bluetooth: Use led_set_brightness() in LED trigger activate() callback 2024-09-10 13:06:11 -04:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
Makefile net: remove ISDN subsystem and Bluetooth CMTP 2026-04-23 10:24:02 -07:00
mgmt_config.c Bluetooth: mgmt: Add idle_timeout to configurable system parameters 2026-01-29 13:24:22 -05:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
mgmt_util.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
mgmt.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
msft.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
msft.h Bluetooth: msft: fix slab-use-after-free in msft_do_close() 2024-05-03 13:05:28 -04:00
sco.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
selftest.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
selftest.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
smp.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
smp.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00