Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports bogus flow-control credits
Summary
rfcomm_getopt SO_RFCOMM_FC_INFO (rfcomm_upper.c:550-551): fc->tx_cred=max(dlc->rd_txcred,0xff) fc->rx_cred=max(dlc->rd_rxcred,0xff). max() should be min() for downward clamp to uint8_t. max(x,255) returns 255 when x<255 (common: rd_txcred default RFCOMM_CREDITS_DEFAULT=7 -> reported 255 not 7) returns raw x when x>=255 then truncated. Pure data correctness wrong value to userspace no mem-safety impact. Kernel flow control uses rd_txcred/rd_rxcred directly unaffected. Fix: min(dlc->rd_txcred,0xff).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0681 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports | 502 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits
Verified recommended fix
Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits
Verdict
Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits
No comments yet.