|
@@ -4092,9 +4092,9 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
|
|
{
|
|
|
struct sock *sk;
|
|
|
struct l2cap_pinfo *pi;
|
|
|
- u16 control, len;
|
|
|
+ u16 control;
|
|
|
u8 tx_seq, req_seq;
|
|
|
- int next_tx_seq_offset, req_seq_offset;
|
|
|
+ int len, next_tx_seq_offset, req_seq_offset;
|
|
|
|
|
|
sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
|
|
|
if (!sk) {
|
|
@@ -4164,7 +4164,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
|
|
}
|
|
|
|
|
|
if (__is_iframe(control)) {
|
|
|
- if (len < 4) {
|
|
|
+ if (len < 0) {
|
|
|
l2cap_send_disconn_req(pi->conn, sk);
|
|
|
goto drop;
|
|
|
}
|
|
@@ -4192,7 +4192,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
|
|
|
if (pi->fcs == L2CAP_FCS_CRC16)
|
|
|
len -= 2;
|
|
|
|
|
|
- if (len > pi->mps || len < 4 || __is_sframe(control))
|
|
|
+ if (len > pi->mps || len < 0 || __is_sframe(control))
|
|
|
goto drop;
|
|
|
|
|
|
if (l2cap_check_fcs(pi, skb))
|