linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  fa768fce4aae7 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  ef20d3012d9e4 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")
  013598897448b ("Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,ead51dc0f3f12..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -5081,14 -5081,14 +5081,14 @@@ static inline int l2cap_ecred_conn_req(
  	cmd_len -= sizeof(*req);
  	num_scid = cmd_len / sizeof(u16);
  
- 	/* Always respond with the same number of scids as in the request */
- 	rsp_len = cmd_len;
- 
  	if (num_scid > L2CAP_ECRED_MAX_CID) {
  		result = L2CAP_CR_LE_INVALID_PARAMS;
  		goto response;
  	}
  
+ 	/* Always respond with the same number of scids as in the request */
+ 	rsp_len = cmd_len;
+ 
  	mtu  = __le16_to_cpu(req->mtu);
  	mps  = __le16_to_cpu(req->mps);
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6690,6 -6697,11 +6697,11 @@@
  	if (!chan->sdu) {
  		u16 sdu_len;
  
+ 		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
+ 			err = -EINVAL;
+ 			goto failed;
+ 		}
+ 
  		sdu_len = get_unaligned_le16(skb->data);
  		skb_pull(skb, L2CAP_SDULEN_SIZE);
  
@@@ -6698,7 -6710,7 +6710,7 @@@
  
  		if (sdu_len > chan->imtu) {
  			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
- 			       skb->len, sdu_len);
+ 			       sdu_len, chan->imtu);
  			l2cap_send_disconn_req(chan, ECONNRESET);
  			err = -EMSGSIZE;
  			goto failed;

Attachment: signature.asc
Description: PGP signature