diff mbox series

[SRU,Focal,v2,4/4] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm

Message ID 20221203184046.554244-5-cengiz.can@canonical.com
State New
Headers show
Series CVE-2022-42896 | expand

Commit Message

Cengiz Can Dec. 3, 2022, 6:40 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

l2cap_global_chan_by_psm shall not return fixed channels as they are not
meant to be connected by (S)PSM.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: Tedd Ho-Jeong An <tedd.an@intel.com>
CVE-2022-42896
(cherry picked from commit f937b758a188d6fd328a81367087eddbb2fce50f)
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 net/bluetooth/l2cap_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 052f1360aec3..76ca7efff25e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1908,7 +1908,7 @@  static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
 		if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
 			continue;
 
-		if (c->psm == psm) {
+		if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
 			int src_match, dst_match;
 			int src_any, dst_any;