SeungJu Cheon 23882b828c Bluetooth: RFCOMM: validate skb length in MCC handlers ...

The RFCOMM MCC handlers cast skb->data to protocol-specific structs
without validating skb->len first. A malicious remote device can send
truncated MCC frames and trigger out-of-bounds reads in these handlers.

Fix this by using skb_pull_data() to validate and access the required
data before dereferencing it.

rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows
1-byte RPN requests. Handle this by validating only the DLCI byte first,
and validating the full struct only when len > 1.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Suggested-by: Muhammad Bilal <[email protected]>
Signed-off-by: SeungJu Cheon <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

2026-06-03 11:21:03 -04:00

..

core.c

Bluetooth: RFCOMM: validate skb length in MCC handlers

2026-06-03 11:21:03 -04:00

Kconfig

…

Makefile

…

sock.c

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

2026-06-03 11:20:03 -04:00

tty.c

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00