Commit 0151e426 authored by Marcel Holtmann's avatar Marcel Holtmann Committed by Johan Hedberg

Bluetooth: Restrict BNEP flags to only valid ones

The BNEP flags should be clearly restricted to valid ones. So this puts
extra checks in place to ensure this.
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
parent 5f5da99f
...@@ -525,6 +525,7 @@ static struct device_type bnep_type = { ...@@ -525,6 +525,7 @@ static struct device_type bnep_type = {
int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
{ {
u32 valid_flags = 0;
struct net_device *dev; struct net_device *dev;
struct bnep_session *s, *ss; struct bnep_session *s, *ss;
u8 dst[ETH_ALEN], src[ETH_ALEN]; u8 dst[ETH_ALEN], src[ETH_ALEN];
...@@ -535,6 +536,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) ...@@ -535,6 +536,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
if (!l2cap_is_socket(sock)) if (!l2cap_is_socket(sock))
return -EBADFD; return -EBADFD;
if (req->flags & ~valid_flags)
return -EINVAL;
baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst); baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);
baswap((void *) src, &l2cap_pi(sock->sk)->chan->src); baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);
...@@ -611,11 +615,15 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) ...@@ -611,11 +615,15 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
int bnep_del_connection(struct bnep_conndel_req *req) int bnep_del_connection(struct bnep_conndel_req *req)
{ {
u32 valid_flags = 0;
struct bnep_session *s; struct bnep_session *s;
int err = 0; int err = 0;
BT_DBG(""); BT_DBG("");
if (req->flags & ~valid_flags)
return -EINVAL;
down_read(&bnep_session_sem); down_read(&bnep_session_sem);
s = __bnep_get_session(req->dst); s = __bnep_get_session(req->dst);
...@@ -631,10 +639,12 @@ int bnep_del_connection(struct bnep_conndel_req *req) ...@@ -631,10 +639,12 @@ int bnep_del_connection(struct bnep_conndel_req *req)
static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s) static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
{ {
u32 valid_flags = 0;
memset(ci, 0, sizeof(*ci)); memset(ci, 0, sizeof(*ci));
memcpy(ci->dst, s->eh.h_source, ETH_ALEN); memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
strcpy(ci->device, s->dev->name); strcpy(ci->device, s->dev->name);
ci->flags = s->flags; ci->flags = s->flags & valid_flags;
ci->state = s->state; ci->state = s->state;
ci->role = s->role; ci->role = s->role;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment