Bluetooth: Fix missing length checks for L2CAP signalling PDUs
authorJohan Hedberg <johan.hedberg@intel.com>
Tue, 28 May 2013 10:46:30 +0000 (13:46 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 12 Jun 2013 14:20:54 +0000 (10:20 -0400)
commita5191e007e5262ee5420d5b8655a935e02d6e4f4
treeae3d09c16bea2dc26496a1155cc08104321d46ae
parent8cf5df9747be5c47ba4f3dbb2e1b184cae632a8f
Bluetooth: Fix missing length checks for L2CAP signalling PDUs

There has been code in place to check that the L2CAP length header
matches the amount of data received, but many PDU handlers have not been
checking that the data received actually matches that expected by the
specific PDU. This patch adds passing the length header to the specific
handler functions and ensures that those functions fail cleanly in the
case of an incorrect amount of data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/bluetooth/l2cap_core.c