Commit 86b1b263 authored by Mat Martineau's avatar Mat Martineau Committed by Marcel Holtmann
Browse files

Bluetooth: Fix endianness issue with L2CAP MPS configuration 



Incoming configuration values must be converted to native CPU order
before use.  This fixes a bug where a little-endian MPS value is
compared to a native CPU value.  On big-endian processors, this
can cause ERTM and streaming mode segmentation to produce PDUs
that are larger than the remote stack is expecting, or that would
produce fragmented skbs that the current FCS code cannot handle.

Signed-off-by: default avatarMat Martineau <mathewm@codeaurora.org>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent c4e9b56e

net/bluetooth/l2cap.c

+5 −4
Original line number Diff line number Diff line
@@ -2705,8 +2705,9 @@ done: 
		case L2CAP_MODE_ERTM:

			pi->remote_tx_win = rfc.txwin_size;

			pi->remote_max_tx = rfc.max_transmit;

			if (rfc.max_pdu_size > pi->conn->mtu - 10)

				rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);



			if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)

				rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);



			pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
@@ -2723,8 +2724,8 @@ done: 
			break;



		case L2CAP_MODE_STREAMING:

			if (rfc.max_pdu_size > pi->conn->mtu - 10)

				rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);

			if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)

				rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);



			pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);

CRA Git | Maintained and supported by SUSTech CRA and CCSE