Bluetooth: mgmt: Don't allow to set invalid value to DeviceID source

Reply with MGMT_STATUS_INVALID_PARAMS when userspace is trying to set
source with out-of-scope value.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 4ccdb78ad4075a7761d056bd03921eb1301e2619..b8f901642b540e0b34736f90e2359bedd0f5308e 100644 (file)
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2532,12 +2532,19 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
 {
        struct mgmt_cp_set_device_id *cp = data;
        int err;
+       __u16 source;
 
        BT_DBG("%s", hdev->name);
 
+       source = __le16_to_cpu(cp->source);
+
+       if (source > 0x0002)
+               return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
+                                 MGMT_STATUS_INVALID_PARAMS);
+
        hci_dev_lock(hdev);
 
-       hdev->devid_source = __le16_to_cpu(cp->source);
+       hdev->devid_source = source;
        hdev->devid_vendor = __le16_to_cpu(cp->vendor);
        hdev->devid_product = __le16_to_cpu(cp->product);
        hdev->devid_version = __le16_to_cpu(cp->version);