diff options
| author |   Johan Hedberg <johan.hedberg@intel.com> | 2015-11-02 14:39:17 +0200 |
|---|---|---|
| committer |   Marcel Holtmann <marcel@holtmann.org> | 2015-11-05 04:04:15 +0100 |
| commit | 40624183c202278e7e0edd01d1273efc87ddd1f2 (patch) | |
| tree | 251b553ddf069d4494ed3840c6f8306ad3143533 /net/bluetooth | |
| parent | Bluetooth: L2CAP: Fix checked range when allocating new CID (diff) | |
| download | linux-dev-40624183c202278e7e0edd01d1273efc87ddd1f2.tar.xz linux-dev-40624183c202278e7e0edd01d1273efc87ddd1f2.zip | |
Bluetooth: L2CAP: Add missing checks for invalid LE DCID
When receiving a connect response we should make sure that the DCID is
within the valid range and that we don't already have another channel
allocated for the same DCID.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index fdb7989e2997..66e8b6ee19a5 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5250,7 +5250,9 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, credits = __le16_to_cpu(rsp->credits); result = __le16_to_cpu(rsp->result); - if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23)) + if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23 || + dcid < L2CAP_CID_DYN_START || + dcid > L2CAP_CID_LE_DYN_END)) return -EPROTO; BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", @@ -5270,6 +5272,11 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, switch (result) { case L2CAP_CR_SUCCESS: + if (__l2cap_get_chan_by_dcid(conn, dcid)) { + err = -EBADSLT; + break; + } + chan->ident = 0; chan->dcid = dcid; chan->omtu = mtu; |