diff options
| author | Johan Hedberg <johan.hedberg@intel.com> | 2013-09-16 13:05:18 +0300 |
|---|---|---|
| committer | Gustavo Padovan <gustavo.padovan@collabora.co.uk> | 2013-09-18 16:50:53 -0500 |
| commit | 69c4e4e8b4ca8440e5cbb66219a179e73f7b9e9a (patch) | |
| tree | 30425e513743c92499c582a33997bb9d4d624ba3 | |
| parent | 9245e7375816c4d94d6327c8761b3c7431a5bc2f (diff) | |
| download | linux-69c4e4e8b4ca8440e5cbb66219a179e73f7b9e9a.tar.gz linux-69c4e4e8b4ca8440e5cbb66219a179e73f7b9e9a.tar.xz | |
Bluetooth: Fix responding to invalid L2CAP signaling commands
When we have an LE link we should not respond to any data on the BR/EDR
L2CAP signaling channel (0x0001) and vice-versa when we have a BR/EDR
link we should not respond to LE L2CAP (CID 0x0005) signaling commands.
This patch fixes this issue by checking for a valid link type and
ignores data if it is wrong.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index b0947ae336df..636a3b4873db 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5311,6 +5311,7 @@ static __le16 l2cap_err_to_reason(int err) static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb) { + struct hci_conn *hcon = conn->hcon; u8 *data = skb->data; int len = skb->len; struct l2cap_cmd_hdr cmd; @@ -5318,6 +5319,9 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, l2cap_raw_recv(conn, skb); + if (hcon->type != LE_LINK) + return; + while (len >= L2CAP_CMD_HDR_SIZE) { u16 cmd_len; memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE); @@ -5355,6 +5359,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb) { + struct hci_conn *hcon = conn->hcon; u8 *data = skb->data; int len = skb->len; struct l2cap_cmd_hdr cmd; @@ -5362,6 +5367,9 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, l2cap_raw_recv(conn, skb); + if (hcon->type != ACL_LINK) + return; + while (len >= L2CAP_CMD_HDR_SIZE) { u16 cmd_len; memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE); |