Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux...

[karo-tx-linux.git] / net / bluetooth / mgmt.c

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 98c92aee623961ab9fbc266b26dd966b8ae58dfd..0054c74e27b7fcd4971477408721b003e773f37a 100644 (file)
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -49,7 +49,7 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
        struct mgmt_hdr *hdr;
        struct mgmt_ev_cmd_status *ev;
 
-       BT_DBG("sock %p", sk);
+       BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 
        skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
        if (!skb)
@@ -92,7 +92,9 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 
        ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
        put_unaligned_le16(cmd, &ev->opcode);
-       memcpy(ev->data, rp, rp_len);
+
+       if (rp)
+               memcpy(ev->data, rp, rp_len);
 
        if (sock_queue_rcv_skb(sk, skb) < 0)
                kfree_skb(skb);
@@ -302,6 +304,9 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
@@ -351,6 +356,9 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
@@ -409,6 +417,9 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
@@ -499,6 +510,9 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
@@ -569,6 +583,9 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
@@ -611,6 +628,9 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
@@ -663,6 +683,9 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 
        BT_DBG("request for hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
@@ -692,6 +715,9 @@ static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
@@ -726,6 +752,10 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
        int i;
 
        cp = (void *) data;
+
+       if (len < sizeof(*cp))
+               return -EINVAL;
+
        key_count = get_unaligned_le16(&cp->key_count);
 
        expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
@@ -775,6 +805,9 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
@@ -821,6 +854,9 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
@@ -863,10 +899,8 @@ failed:
        return err;
 }
 
-static int get_connections(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int get_connections(struct sock *sk, u16 index)
 {
-       struct mgmt_cp_get_connections *cp;
        struct mgmt_rp_get_connections *rp;
        struct hci_dev *hdev;
        struct list_head *p;
@@ -876,8 +910,6 @@ static int get_connections(struct sock *sk, u16 index, unsigned char *data,
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
@@ -931,6 +963,9 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
@@ -975,6 +1010,10 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                                                       EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
@@ -995,7 +1034,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                goto failed;
        }
 
-       err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(bdaddr_t),
+       err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
                                                                &cp->bdaddr);
        if (err < 0)
                mgmt_pending_remove(cmd);
@@ -1017,6 +1056,9 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
@@ -1026,7 +1068,7 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
        hdev->io_capability = cp->io_capability;
 
        BT_DBG("%s IO capability set to 0x%02x", hdev->name,
-                                               hdev->io_capability);
+                                                       hdev->io_capability);
 
        hci_dev_unlock_bh(hdev);
        hci_dev_put(hdev);
@@ -1107,6 +1149,9 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        cp = (void *) data;
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
@@ -1122,8 +1167,8 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
        }
 
        conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level, auth_type);
-       if (!conn) {
-               err = -ENOMEM;
+       if (IS_ERR(conn)) {
+               err = PTR_ERR(conn);
                goto unlock;
        }
 
@@ -1178,6 +1223,9 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
                hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
        }
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, mgmt_op, EINVAL);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, mgmt_op, ENODEV);
@@ -1279,7 +1327,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                err = disconnect(sk, index, buf + sizeof(*hdr), len);
                break;
        case MGMT_OP_GET_CONNECTIONS:
-               err = get_connections(sk, index, buf + sizeof(*hdr), len);
+               err = get_connections(sk, index);
                break;
        case MGMT_OP_PIN_CODE_REPLY:
                err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
@@ -1374,8 +1422,7 @@ int mgmt_discoverable(u16 index, u8 discoverable)
        struct cmd_lookup match = { discoverable, NULL };
        int ret;
 
-       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index,
-                                                       mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
 
        ev.val = discoverable;
 
@@ -1581,8 +1628,7 @@ int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
                                                MGMT_OP_USER_CONFIRM_REPLY);
 }
 
-int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr,
-                                                               u8 status)
+int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
 {
        return confirm_reply_complete(index, bdaddr, status,
                                        MGMT_OP_USER_CONFIRM_NEG_REPLY);