diff options
| author | Ville Tervo <ville.tervo@nokia.com> | 2010-08-04 09:43:33 +0300 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2010-08-04 07:25:17 -0700 |
| commit | adb08edea0119f7a5484a9f6a385fbcecdf85a63 (patch) | |
| tree | 32b623c88a568b6a6539adf2196f816b9ed650df /net | |
| parent | 6340650400525a9ca8d86b1b4501cc50670dce0d (diff) | |
| download | linux-3.10-adb08edea0119f7a5484a9f6a385fbcecdf85a63.tar.gz linux-3.10-adb08edea0119f7a5484a9f6a385fbcecdf85a63.tar.bz2 linux-3.10-adb08edea0119f7a5484a9f6a385fbcecdf85a63.zip | |
Bluetooth: Check result code of L2CAP information response
Check result code of L2CAP information response. Otherwise
it would read invalid feature mask and access invalid memory.
Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/l2cap.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 0f34e127514..3e3cd9d4e52 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -3348,6 +3348,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm del_timer(&conn->info_timer); + if (result != L2CAP_IR_SUCCESS) { + conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; + conn->info_ident = 0; + + l2cap_conn_start(conn); + + return 0; + } + if (type == L2CAP_IT_FEAT_MASK) { conn->feat_mask = get_unaligned_le32(rsp->data); |