diff options
| author | Philippe Schenker <philippe.schenker@toradex.com> | 2022-05-19 16:29:13 +0200 |
|---|---|---|
| committer | Philippe Schenker <philippe.schenker@toradex.com> | 2022-05-19 16:29:13 +0200 |
| commit | e6fb5c32f78f99682821f91b3959e222c93e4cb9 (patch) | |
| tree | 3f6c281a7d83a6e3c0a153f93718f7cd9a39b6f7 /net/bluetooth | |
| parent | 585dc27c53b6c1a32a7e11b724e91d7297388a13 (diff) | |
| parent | b7007e1d615b8d4b71c28ebf790c5164fc4491d5 (diff) | |
Merge remote-tracking branch 'gh-fslc/5.4-2.3.x-imx' into toradex_5.4-2.3.x-imx
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/cmtp/core.c | 4 | ||||
| -rw-r--r-- | net/bluetooth/hci_core.c | 1 | ||||
| -rw-r--r-- | net/bluetooth/hci_event.c | 11 |
3 files changed, 11 insertions, 5 deletions
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 0a2d78e811cf..83eb84e8e688 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -501,9 +501,7 @@ static int __init cmtp_init(void) { BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); - cmtp_init_sockets(); - - return 0; + return cmtp_init_sockets(); } static void __exit cmtp_exit(void) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 811f1b9a7eca..a0f88081d56e 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3410,6 +3410,7 @@ int hci_register_dev(struct hci_dev *hdev) return id; err_wqueue: + debugfs_remove_recursive(hdev->debugfs); destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); err: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 786c5b67bc0b..406c6b4eba82 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4950,8 +4950,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, hci_dev_lock(hdev); hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); - if (hcon) { + if (hcon && hcon->type == AMP_LINK) { hcon->state = BT_CLOSED; + hci_disconn_cfm(hcon, ev->reason); hci_conn_del(hcon); } @@ -5545,7 +5546,13 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev = ptr; s8 rssi; - if (ev->length <= HCI_MAX_AD_LENGTH) { + if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data."); + break; + } + + if (ev->length <= HCI_MAX_AD_LENGTH && + ev->data + ev->length <= skb_tail_pointer(skb)) { rssi = ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, |