malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bluetooth: Restrict BNEP flags to only valid ones

Browse Source 
The BNEP flags should be clearly restricted to valid ones. So this puts
extra checks in place to ensure this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
Marcel Holtmann 2015-04-01 13:51:54 -07:00 committed by Johan Hedberg
parent 5f5da99f1d
commit 0151e426b1
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/bluetooth/bnep/core.c
View File

@ -525,6 +525,7 @@ static struct device_type bnep_type = {
int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
{ {
u32 valid_flags = 0;
struct net_device *dev; struct net_device *dev;
struct bnep_session *s, *ss; struct bnep_session *s, *ss;
u8 dst[ETH_ALEN], src[ETH_ALEN]; u8 dst[ETH_ALEN], src[ETH_ALEN];
@ -535,6 +536,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
if (!l2cap_is_socket(sock)) if (!l2cap_is_socket(sock))
return -EBADFD; return -EBADFD;
if (req->flags & ~valid_flags)
return -EINVAL;
baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst); baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);
baswap((void *) src, &l2cap_pi(sock->sk)->chan->src); baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);
@ -611,11 +615,15 @@ failed:
int bnep_del_connection(struct bnep_conndel_req *req) int bnep_del_connection(struct bnep_conndel_req *req)
{ {
u32 valid_flags = 0;
struct bnep_session *s; struct bnep_session *s;
int err = 0; int err = 0;
BT_DBG(""); BT_DBG("");
if (req->flags & ~valid_flags)
return -EINVAL;
down_read(&bnep_session_sem); down_read(&bnep_session_sem);
s = __bnep_get_session(req->dst); s = __bnep_get_session(req->dst);
@ -631,10 +639,12 @@ int bnep_del_connection(struct bnep_conndel_req *req)
static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s) static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
{ {
u32 valid_flags = 0;
memset(ci, 0, sizeof(*ci)); memset(ci, 0, sizeof(*ci));
memcpy(ci->dst, s->eh.h_source, ETH_ALEN); memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
strcpy(ci->device, s->dev->name); strcpy(ci->device, s->dev->name);
ci->flags = s->flags; ci->flags = s->flags & valid_flags;
ci->state = s->state; ci->state = s->state;
ci->role = s->role; ci->role = s->role;
} }