Module Name: src Committed By: plunky Date: Fri Sep 7 14:47:15 UTC 2018
Modified Files: src/sys/netbt: hci_link.c Log Message: two issues noted by maxv@ 1. If an adaptor sends repeated fragments indicating HCI_PACKET_START, we would leak mbufs. Fix that by releasing the previous in that case. 2. If an adaptor sends fragments which overflow the expected total payload length, it could build up the pending packet to use up system mbufs. Fix that by changing the unsigned calculation to a comparison and rejecting oversize packets To generate a diff of this commit: cvs rdiff -u -r1.24 -r1.25 src/sys/netbt/hci_link.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netbt/hci_link.c diff -u src/sys/netbt/hci_link.c:1.24 src/sys/netbt/hci_link.c:1.25 --- src/sys/netbt/hci_link.c:1.24 Tue May 20 18:25:54 2014 +++ src/sys/netbt/hci_link.c Fri Sep 7 14:47:15 2018 @@ -1,4 +1,4 @@ -/* $NetBSD: hci_link.c,v 1.24 2014/05/20 18:25:54 rmind Exp $ */ +/* $NetBSD: hci_link.c,v 1.25 2018/09/07 14:47:15 plunky Exp $ */ /*- * Copyright (c) 2005 Iain Hibbert. @@ -31,7 +31,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: hci_link.c,v 1.24 2014/05/20 18:25:54 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: hci_link.c,v 1.25 2018/09/07 14:47:15 plunky Exp $"); #include <sys/param.h> #include <sys/kernel.h> @@ -475,12 +475,15 @@ hci_acl_recv(struct mbuf *m, struct hci_ switch (pb) { case HCI_PACKET_START: - if (link->hl_rxp != NULL) + if (m->m_pkthdr.len < sizeof(l2cap_hdr_t)) + goto bad; + + if (link->hl_rxp != NULL) { aprint_error_dev(unit->hci_dev, "dropped incomplete ACL packet\n"); - if (m->m_pkthdr.len < sizeof(l2cap_hdr_t)) - goto bad; + m_freem(link->hl_rxp); + } link->hl_rxp = m; got = m->m_pkthdr.len; @@ -508,18 +511,24 @@ hci_acl_recv(struct mbuf *m, struct hci_ } m_copydata(m, 0, sizeof(want), &want); - want = le16toh(want) + sizeof(l2cap_hdr_t) - got; + want = le16toh(want); + got -= sizeof(l2cap_hdr_t); - if (want > 0) + if (got < want) /* wait for more */ return; link->hl_rxp = NULL; - if (want == 0) { - l2cap_recv_frame(m, link); - return; + if (got > want) { + DPRINTF("%s: packet overflow\n", + device_xname(unit->hci_dev)); + + goto bad; } + l2cap_recv_frame(m, link); + return; + bad: m_freem(m); }