Bluetooth: Check packet FCS earlier
This way, if FCS is enabled and the packet is corrupted, we just drop it without read it len, which could be corrupted. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
parent
45d65c46ac
commit
2600008967
|
@ -4166,25 +4166,25 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
||||||
skb_pull(skb, 2);
|
skb_pull(skb, 2);
|
||||||
len = skb->len;
|
len = skb->len;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* We can just drop the corrupted I-frame here.
|
||||||
|
* Receiver will miss it and start proper recovery
|
||||||
|
* procedures and ask retransmission.
|
||||||
|
*/
|
||||||
|
if (l2cap_check_fcs(pi, skb))
|
||||||
|
goto drop;
|
||||||
|
|
||||||
if (__is_sar_start(control) && __is_iframe(control))
|
if (__is_sar_start(control) && __is_iframe(control))
|
||||||
len -= 2;
|
len -= 2;
|
||||||
|
|
||||||
if (pi->fcs == L2CAP_FCS_CRC16)
|
if (pi->fcs == L2CAP_FCS_CRC16)
|
||||||
len -= 2;
|
len -= 2;
|
||||||
|
|
||||||
/*
|
|
||||||
* We can just drop the corrupted I-frame here.
|
|
||||||
* Receiver will miss it and start proper recovery
|
|
||||||
* procedures and ask retransmission.
|
|
||||||
*/
|
|
||||||
if (len > pi->mps) {
|
if (len > pi->mps) {
|
||||||
l2cap_send_disconn_req(pi->conn, sk);
|
l2cap_send_disconn_req(pi->conn, sk);
|
||||||
goto drop;
|
goto drop;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (l2cap_check_fcs(pi, skb))
|
|
||||||
goto drop;
|
|
||||||
|
|
||||||
req_seq = __get_reqseq(control);
|
req_seq = __get_reqseq(control);
|
||||||
req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
|
req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
|
||||||
if (req_seq_offset < 0)
|
if (req_seq_offset < 0)
|
||||||
|
@ -4224,6 +4224,9 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
||||||
skb_pull(skb, 2);
|
skb_pull(skb, 2);
|
||||||
len = skb->len;
|
len = skb->len;
|
||||||
|
|
||||||
|
if (l2cap_check_fcs(pi, skb))
|
||||||
|
goto drop;
|
||||||
|
|
||||||
if (__is_sar_start(control))
|
if (__is_sar_start(control))
|
||||||
len -= 2;
|
len -= 2;
|
||||||
|
|
||||||
|
@ -4233,9 +4236,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
||||||
if (len > pi->mps || len < 0 || __is_sframe(control))
|
if (len > pi->mps || len < 0 || __is_sframe(control))
|
||||||
goto drop;
|
goto drop;
|
||||||
|
|
||||||
if (l2cap_check_fcs(pi, skb))
|
|
||||||
goto drop;
|
|
||||||
|
|
||||||
tx_seq = __get_txseq(control);
|
tx_seq = __get_txseq(control);
|
||||||
|
|
||||||
if (pi->expected_tx_seq == tx_seq)
|
if (pi->expected_tx_seq == tx_seq)
|
||||||
|
|
Loading…
Reference in a new issue