Hui Peng f0ca020cbb Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough ...

Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing:

1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),
   use pskb_may_pull() to verify the BNEP header, control type byte,
   filter count, and extension headers exist before reading them, and
   return 0 after handling BNEP_CONTROL instead of falling through to
   Ethernet frame submission when no extension headers follow.
2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=
   ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet
   header to prevent an out-of-bounds heap read and infoleak on short
   AF_PACKET TX frames.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

2026-09-21 09:37:19 -04:00

..

bnep.h

…

core.c

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

2026-09-21 09:37:19 -04:00

Kconfig

Bluetooth: fix BT dependency for submodules

2026-08-07 15:38:30 -04:00

Makefile

Bluetooth: enable context analysis

2026-08-07 12:27:20 -04:00

netdev.c

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

2026-09-21 09:37:19 -04:00

sock.c

Bluetooth: Add SPDX id lines to some source files

2026-06-11 14:24:41 -04:00