From ca581a4c85288be44cc99678356c46c06a7a61bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcin=20Wcis=C5=82o?= Date: Thu, 16 Jan 2025 23:26:36 +0100 Subject: [PATCH] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit jira VULN-209 cve CVE-2022-42896 commit-author Luiz Augusto von Dentz commit f937b758a188d6fd328a81367087eddbb2fce50f l2cap_global_chan_by_psm shall not return fixed channels as they are not meant to be connected by (S)PSM. Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Tedd Ho-Jeong An (cherry picked from commit f937b758a188d6fd328a81367087eddbb2fce50f) Signed-off-by: Marcin Wcisło --- net/bluetooth/l2cap_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index cc4f3f7a4c536..dd037c78c93bd 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1984,7 +1984,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) continue; - if (c->psm == psm) { + if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) { int src_match, dst_match; int src_any, dst_any;