From: Marcel Holtmann <marcel@holtmann.org>
Date: Thu, 3 Oct 2013 08:23:08 +0000 (-0700)
Subject: Bluetooth: Check minimum length of SMP packets
X-Git-Tag: v3.13-rc1~105^2~225^2~24^2~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=92381f5cd72b3fb415efe2406ad9fa462a223151;p=profile%2Fivi%2Fkernel-x86-ivi.git

Bluetooth: Check minimum length of SMP packets

When SMP packets are received, make sure they contain at least 1 byte
header for the opcode. If not, drop the packet and disconnect the link.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6e049497..884b208 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -848,8 +848,7 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 {
 	struct hci_conn *hcon = conn->hcon;
-	__u8 code = skb->data[0];
-	__u8 reason;
+	__u8 code, reason;
 	int err = 0;
 
 	if (hcon->type != LE_LINK) {
@@ -857,12 +856,18 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 		return -ENOTSUPP;
 	}
 
+	if (skb->len < 1) {
+		kfree_skb(skb);
+		return -EILSEQ;
+	}
+
 	if (!test_bit(HCI_LE_ENABLED, &conn->hcon->hdev->dev_flags)) {
 		err = -ENOTSUPP;
 		reason = SMP_PAIRING_NOTSUPP;
 		goto done;
 	}
 
+	code = skb->data[0];
 	skb_pull(skb, sizeof(code));
 
 	/*