From patchwork Mon May 10 09:37:32 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Marcel Holtmann X-Patchwork-Id: 52056 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 8E242B7D41 for ; Mon, 10 May 2010 19:42:56 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756111Ab0EJJm2 (ORCPT ); Mon, 10 May 2010 05:42:28 -0400 Received: from senator.holtmann.net ([87.106.208.187]:53463 "EHLO mail.holtmann.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755884Ab0EJJjF (ORCPT ); Mon, 10 May 2010 05:39:05 -0400 Received: from localhost.localdomain (unknown [80.187.218.46]) by mail.holtmann.org (Postfix) with ESMTP id AFC2D8B57A; Mon, 10 May 2010 11:39:00 +0200 (CEST) From: Marcel Holtmann To: David Miller Cc: netdev@vger.kernel.org Subject: [PATCH 42/64] Bluetooth: Close L2CAP channel on invalid ReqSeq Date: Mon, 10 May 2010 11:37:32 +0200 Message-Id: <01760bdde9a92413b7fff928d08e19352bf09d82.1273484098.git.marcel@holtmann.org> X-Mailer: git-send-email 1.6.6.1 In-Reply-To: References: <4f7ac1814ef6f0773e57ffd159a1dd57a3c80521.1273484095.git.marcel@holtmann.org> <0d861d8b8edd139a9b291cb262d08dec8dc3922d.1273484095.git.marcel@holtmann.org> <7dffe4210233a2860c3f41477c40b3252edf2b7d.1273484095.git.marcel@holtmann.org> <1d8f5d16913d74e428950ee02fe9ff7e6391c120.1273484096.git.marcel@holtmann.org> <277ffbe362823d18a17792fbd8e507010e666299.1273484096.git.marcel@holtmann.org> <36f2fd585f43199f006a3b5ff84e95815102cd31.1273484096.git.marcel@holtmann.org> <9e917af13d59182f95bbb5483dc0c4254dfb7944.1273484096.git.marcel@holtmann.org> <73edaa9933219e25d6733b78d1e2c881025705e2.1273484096.git.marcel@holtmann.org> <99b0d4b7b09edeacf4542bced5c01239375b51a9.1273484096.git.marcel@holtmann.org> <6e3a59819fac19006fe4255b87928e5a12c54532.1273484096.git.marcel@holtmann.org> <8abb52ee00c4b3f857269eb6b7145991bab869bf.1273484096.git.marcel@holtmann.org> <05fbd89dd4153341717b33d9e8ae8bd29db6c1c8.1273484096.git.marcel@holtmann.org> <2fb862e215e53630066c677e06d7551fa38bf235.1273484097.git.marcel@holtmann.org> <7b1c0049be3aabc18831ada339dbcf41ba8c81fd.1273484097.git.marcel@holtmann.org> <1c7621596d11b9c3e19eb88a818758dee4901c95.1273484097.git.marcel@holtmann.org> <10467e9e9b89272b25b56688bb276d0830e9ab9a.1273484097.git.marcel@holtmann.org> <052897ca5019d9157ae09e5e84eee2a9ef5dccc6.1273484097.git.marcel@holtmann.org> <855666cccc939d392316de17512e17a08b2fa05a.1273484097.git.marcel@holtmann.org> <14b5aa71ec506f4e38ca6a1dc02ecd668ecfd902.1273484097.git.marcel@holtmann.org> <803020c6fa63aa738cfda3329c9675b42023e9d2.1273484097.git.marcel@holtmann.org> <369ba30264826f38eefc61b93688100be8adbd4d.1273484097.git.marcel@holtmann.org> <68d7f0ce911e41e463c45911be031cdf6a096fe8.1273484097.git.marcel@holtmann.org> <0ee0d20855ae9271de3f6695f4cafc08ab2533bb.1273484097.git.marcel@holtmann.org> <812e737e29a1d559e7bfbea675fdcfcbad9f5e1f.1273484097.git.marcel@holtmann.org> <3b1a9f3fa6ad842991538da2c3b2e29e047b131f.1273484097.git.marcel@holtmann.org> <84fb0a6334af0ccad3544f6972c055d90fbb9fbe.1273484097.git.marcel@holtmann.org> <0041ecfa3025d7612fdaab12b2f07c9c3c09f42f.1273484098.git.marcel@holtmann.org> In-Reply-To: References: MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: João Paulo Rechi Vita Signed-off-by: João Paulo Rechi Vita Acked-by: Gustavo F. Padovan Signed-off-by: Marcel Holtmann --- net/bluetooth/l2cap.c | 18 +++++++++++++++++- 1 files changed, 17 insertions(+), 1 deletions(-) diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 478def7..31514d8 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -3772,7 +3772,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk struct sock *sk; struct l2cap_pinfo *pi; u16 control, len; - u8 tx_seq; + u8 tx_seq, req_seq, next_tx_seq_offset, req_seq_offset; sk = l2cap_get_chan_by_scid(&conn->chan_list, cid); if (!sk) { @@ -3823,6 +3823,22 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk if (l2cap_check_fcs(pi, skb)) goto drop; + req_seq = __get_reqseq(control); + req_seq_offset = (req_seq - pi->expected_ack_seq) % 64; + if (req_seq_offset < 0) + req_seq_offset += 64; + + next_tx_seq_offset = + (pi->next_tx_seq - pi->expected_ack_seq) % 64; + if (next_tx_seq_offset < 0) + next_tx_seq_offset += 64; + + /* check for invalid req-seq */ + if (req_seq_offset > next_tx_seq_offset) { + l2cap_send_disconn_req(pi->conn, sk); + goto drop; + } + if (__is_iframe(control)) { if (len < 4) goto drop;