diff options
| author |   Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-04-23 23:31:00 +0800 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-06 16:23:20 -0400 |
| commit | 8f59d17b18a78fdfdbb67d693b3d3eb03db184e0 (patch) | |
| tree | 6fdf0b512a4182b84e91c2f1f95eaeaa25b617c4 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: virtio_bt: validate rx pkt_type header length (diff) | |
Bluetooth: RFCOMM: pull credit byte with skb_pull_data()
rfcomm_recv_data() treats the first payload byte as a credit field when
the UIH frame carries PF and credit-based flow control is enabled.
After the header has been stripped, the PF/CFC path consumes that byte
with a direct skb->data dereference followed by skb_pull(). A malformed
short frame can reach this path without a byte available.
Use skb_pull_data() so the length check and pull happen together before
the returned credit byte is consumed.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions