From patchwork Mon May 10 09:37:04 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Marcel Holtmann X-Patchwork-Id: 52067 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id BF211B7D4A for ; Mon, 10 May 2010 19:44:42 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755820Ab0EJJiy (ORCPT ); Mon, 10 May 2010 05:38:54 -0400 Received: from senator.holtmann.net ([87.106.208.187]:53431 "EHLO mail.holtmann.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755653Ab0EJJir (ORCPT ); Mon, 10 May 2010 05:38:47 -0400 Received: from localhost.localdomain (unknown [80.187.218.46]) by mail.holtmann.org (Postfix) with ESMTP id DC3118B4D8; Mon, 10 May 2010 11:38:42 +0200 (CEST) From: Marcel Holtmann To: David Miller Cc: netdev@vger.kernel.org Subject: [PATCH 14/64] Bluetooth: Check if SDU size is greater than MTU on L2CAP Date: Mon, 10 May 2010 11:37:04 +0200 Message-Id: <36f2fd585f43199f006a3b5ff84e95815102cd31.1273484096.git.marcel@holtmann.org> X-Mailer: git-send-email 1.6.6.1 In-Reply-To: <277ffbe362823d18a17792fbd8e507010e666299.1273484096.git.marcel@holtmann.org> References: <4f7ac1814ef6f0773e57ffd159a1dd57a3c80521.1273484095.git.marcel@holtmann.org> <0d861d8b8edd139a9b291cb262d08dec8dc3922d.1273484095.git.marcel@holtmann.org> <7dffe4210233a2860c3f41477c40b3252edf2b7d.1273484095.git.marcel@holtmann.org> <1d8f5d16913d74e428950ee02fe9ff7e6391c120.1273484096.git.marcel@holtmann.org> <277ffbe362823d18a17792fbd8e507010e666299.1273484096.git.marcel@holtmann.org> In-Reply-To: References: MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Gustavo F. Padovan After reassembly the SDU we need to check his size. It can't overflow the MTU size. Signed-off-by: Gustavo F. Padovan Reviewed-by: João Paulo Rechi Vita Signed-off-by: Marcel Holtmann --- net/bluetooth/l2cap.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index ac00f5f..2e354d2 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -3277,15 +3277,19 @@ static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 co pi->conn_state &= ~L2CAP_CONN_SAR_SDU; pi->partial_sdu_len += skb->len; + if (pi->partial_sdu_len > pi->imtu) + goto drop; + if (pi->partial_sdu_len == pi->sdu_len) { _skb = skb_clone(pi->sdu, GFP_ATOMIC); err = sock_queue_rcv_skb(sk, _skb); if (err < 0) kfree_skb(_skb); } - kfree_skb(pi->sdu); err = 0; +drop: + kfree_skb(pi->sdu); break; }