diff options
| author | Chandrashekar Devegowda <chandrashekar.devegowda@intel.com> | 2026-09-22 12:10:21 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-09-23 09:29:27 -0400 |
| commit | 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea (patch) | |
| tree | 3dd839504b96d25e67acd0ca60f063405ceec451 /include/net | |
| parent | 40eb4b18ad167b63644c27fa67a7400ba050379a (diff) | |
Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen
is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the
"skb->len < plen" check and letting skb_trim() truncate the packet.
Widen plen to u32 so the addition cannot wrap.
Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/net')
0 files changed, 0 insertions, 0 deletions