diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2015-10-09 16:13:50 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2015-10-21 00:49:21 +0200 |
| commit | bb77543ebd2e38c08412fec7eb1e35b902c5ff77 (patch) | |
| tree | a46858968a104b007ae9bc8ddbd280ad0088100a | |
| parent | 8cd4f581427213e086fca601bb9d8c7ea9cfeabc (diff) | |
| download | linux-bb77543ebd2e38c08412fec7eb1e35b902c5ff77.tar.gz linux-bb77543ebd2e38c08412fec7eb1e35b902c5ff77.tar.bz2 linux-bb77543ebd2e38c08412fec7eb1e35b902c5ff77.zip | |
Bluetooth: Restrict valid packet types via HCI_CHANNEL_RAW
When using the HCI_CHANNEL_RAW, restrict the packet types to valid ones
from the Bluetooth specification.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
| -rw-r--r-- | net/bluetooth/hci_sock.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index bad86dfe134f..1f4665a124f6 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -170,6 +170,11 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) continue; if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { + if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT && + bt_cb(skb)->pkt_type != HCI_EVENT_PKT && + bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT && + bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) + continue; if (is_filtered_packet(sk, skb)) continue; } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { @@ -1247,6 +1252,12 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, goto drop; } + if (bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT && + bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) { + err = -EINVAL; + goto drop; + } + skb_queue_tail(&hdev->raw_q, skb); queue_work(hdev->workqueue, &hdev->tx_work); } |