diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2015-10-08 03:14:28 +0200 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2015-10-08 10:05:41 +0300 |
| commit | fe806dceded462f7930f8ac4a41c5d19819e70b7 (patch) | |
| tree | df547e40bdb9bc5ddb959eb66d9b405159730d41 /net/bluetooth | |
| parent | 943cc592195ea458058c121d9c4d7481d0f28be1 (diff) | |
| download | linux-fe806dceded462f7930f8ac4a41c5d19819e70b7.tar.gz linux-fe806dceded462f7930f8ac4a41c5d19819e70b7.tar.bz2 linux-fe806dceded462f7930f8ac4a41c5d19819e70b7.zip | |
Bluetooth: Enforce packet types in hci_recv_frame driver function
When calling the hci_recv_frame driver function check for valid packet
types that the core should process. This should catch issues with
drivers trying to feed vendor packet types through this interface.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/hci_core.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 43a1f2d8ffd3..b2095ca8472e 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3538,6 +3538,13 @@ int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) return -ENXIO; } + if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT && + bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT && + bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) { + kfree_skb(skb); + return -EINVAL; + } + /* Incoming skb */ bt_cb(skb)->incoming = 1; |