| Message ID | 20231219081022.41395-1-frederic.danis@collabora.com |
|---|---|
| State | Accepted |
| Commit | 96a3398b467ab8aada3df2f3a79f4b7835d068b8 |
| Headers | show |
| Series | Bluetooth: L2CAP: Fix possible multiple reject send | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=811317 ---Test result--- Test Summary: CheckPatch PASS 0.65 seconds GitLint PASS 0.36 seconds SubjectPrefix PASS 0.13 seconds BuildKernel PASS 28.24 seconds CheckAllWarning PASS 30.86 seconds CheckSparse PASS 36.64 seconds CheckSmatch PASS 100.01 seconds BuildKernel32 PASS 29.65 seconds TestRunnerSetup PASS 437.46 seconds TestRunner_l2cap-tester PASS 23.32 seconds TestRunner_iso-tester PASS 44.93 seconds TestRunner_bnep-tester PASS 6.83 seconds TestRunner_mgmt-tester PASS 160.83 seconds TestRunner_rfcomm-tester PASS 10.86 seconds TestRunner_sco-tester PASS 17.82 seconds TestRunner_ioctl-tester PASS 12.13 seconds TestRunner_mesh-tester PASS 8.80 seconds TestRunner_smp-tester PASS 10.14 seconds TestRunner_userchan-tester PASS 7.81 seconds IncrementalBuild PASS 26.58 seconds --- Regards, Linux Bluetooth
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Tue, 19 Dec 2023 09:10:22 +0100 you wrote: > In case of an incomplete command or a command with a null identifier 2 > reject packets will be sent, one with the identifier and one with 0. > Consuming the data of the command will prevent it. > This allows to send a reject packet for each corrupted command in a > multi-command packet. > > Signed-off-by: Frédéric Danis <frederic.danis@collabora.com> > > [...] Here is the summary with links: - Bluetooth: L2CAP: Fix possible multiple reject send https://git.kernel.org/bluetooth/bluetooth-next/c/ff1bb03a94dc You are awesome, thank you!
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index baeebee41cd9..60298975d5c4 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6526,7 +6526,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, if (len > skb->len || !cmd->ident) { BT_DBG("corrupted command"); l2cap_sig_send_rej(conn, cmd->ident); - break; + skb_pull(skb, len > skb->len ? skb->len : len); + continue; } err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
In case of an incomplete command or a command with a null identifier 2 reject packets will be sent, one with the identifier and one with 0. Consuming the data of the command will prevent it. This allows to send a reject packet for each corrupted command in a multi-command packet. Signed-off-by: Frédéric Danis <frederic.danis@collabora.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)