From: Frédéric Danis <frederic.danis@collabora.com>
Date: Tue, 19 Dec 2023 08:10:22 +0000 (+0100)
Subject: Bluetooth: L2CAP: Fix possible multiple reject send
X-Git-Tag: v6.6.17~305
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=100089a1ec709731d2fbb4c2d823c5eb339bed59;p=platform%2Fkernel%2Flinux-starfive.git

Bluetooth: L2CAP: Fix possible multiple reject send

[ Upstream commit 96a3398b467ab8aada3df2f3a79f4b7835d068b8 ]

In case of an incomplete command or a command with a null identifier 2
reject packets will be sent, one with the identifier and one with 0.
Consuming the data of the command will prevent it.
This allows to send a reject packet for each corrupted command in a
multi-command packet.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index baeebee..6029897 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6526,7 +6526,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 		if (len > skb->len || !cmd->ident) {
 			BT_DBG("corrupted command");
 			l2cap_sig_send_rej(conn, cmd->ident);
-			break;
+			skb_pull(skb, len > skb->len ? skb->len : len);
+			continue;
 		}
 
 		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);