hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: Restrict HIDP flags to only valid ones 

The HIDP flags should be clearly restricted to valid ones. So this puts
extra checks in place to ensure this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
Marcel Holtmann 2015-04-01 13:51:53 -07:00 committed by Johan Hedberg
parent 8bf17a3619
commit 5f5da99f1d
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/bluetooth/hidp/core.c
View File

@ -70,10 +70,11 @@ static void hidp_session_terminate(struct hidp_session *s);
static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci) static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
{ {
u32 valid_flags = 0;
memset(ci, 0, sizeof(*ci)); memset(ci, 0, sizeof(*ci));
bacpy(&ci->bdaddr, &session->bdaddr); bacpy(&ci->bdaddr, &session->bdaddr);
ci->flags = session->flags; ci->flags = session->flags & valid_flags;
ci->state = BT_CONNECTED; ci->state = BT_CONNECTED;
if (session->input) { if (session->input) {
@ -1312,6 +1313,7 @@ int hidp_connection_add(struct hidp_connadd_req *req,
struct socket *ctrl_sock, struct socket *ctrl_sock,
struct socket *intr_sock) struct socket *intr_sock)
{ {
u32 valid_flags = 0;
struct hidp_session *session; struct hidp_session *session;
struct l2cap_conn *conn; struct l2cap_conn *conn;
struct l2cap_chan *chan; struct l2cap_chan *chan;
@ -1321,6 +1323,9 @@ int hidp_connection_add(struct hidp_connadd_req *req,
if (ret) if (ret)
return ret; return ret;
if (req->flags & ~valid_flags)
return -EINVAL;
chan = l2cap_pi(ctrl_sock->sk)->chan; chan = l2cap_pi(ctrl_sock->sk)->chan;
conn = NULL; conn = NULL;
l2cap_chan_lock(chan); l2cap_chan_lock(chan);
@ -1351,8 +1356,12 @@ out_conn:
int hidp_connection_del(struct hidp_conndel_req *req) int hidp_connection_del(struct hidp_conndel_req *req)
{ {
u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG);
struct hidp_session *session; struct hidp_session *session;
if (req->flags & ~valid_flags)
return -EINVAL;
session = hidp_session_find(&req->bdaddr); session = hidp_session_find(&req->bdaddr);
if (!session) if (!session)
return -ENOENT; return -ENOENT;