Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

[net-next-2.6.git] / net / bluetooth / l2cap.c

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index dc6020570a3202423aa53feafc1ac41584c58983..daa7a988d9a6b4de7c7767748f1f18e1524cb78f 100644 (file)
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1008,10 +1008,20 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                goto done;
        }
 
-       if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
-                               !capable(CAP_NET_BIND_SERVICE)) {
-               err = -EACCES;
-               goto done;
+       if (la.l2_psm) {
+               __u16 psm = __le16_to_cpu(la.l2_psm);
+
+               /* PSM must be odd and lsb of upper byte must be 0 */
+               if ((psm & 0x0101) != 0x0001) {
+                       err = -EINVAL;
+                       goto done;
+               }
+
+               /* Restrict usage of well-known PSMs */
+               if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
+                       err = -EACCES;
+                       goto done;
+               }
        }
 
        write_lock_bh(&l2cap_sk_list.lock);
@@ -1190,6 +1200,13 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
                goto done;
        }
 
+       /* PSM must be odd and lsb of upper byte must be 0 */
+       if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
+               sk->sk_type != SOCK_RAW) {
+               err = -EINVAL;
+               goto done;
+       }
+
        /* Set destination address and psm */
        bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
        l2cap_pi(sk)->psm = la.l2_psm;
@@ -1635,7 +1652,7 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
 
                *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
                if (!*frag)
-                       return -EFAULT;
+                       return err;
                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
                        return -EFAULT;
 
@@ -1661,7 +1678,7 @@ static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr
        skb = bt_skb_send_alloc(sk, count + hlen,
                        msg->msg_flags & MSG_DONTWAIT, &err);
        if (!skb)
-               return ERR_PTR(-ENOMEM);
+               return ERR_PTR(err);
 
        /* Create L2CAP header */
        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1690,7 +1707,7 @@ static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *ms
        skb = bt_skb_send_alloc(sk, count + hlen,
                        msg->msg_flags & MSG_DONTWAIT, &err);
        if (!skb)
-               return ERR_PTR(-ENOMEM);
+               return ERR_PTR(err);
 
        /* Create L2CAP header */
        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1727,7 +1744,7 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *m
        skb = bt_skb_send_alloc(sk, count + hlen,
                        msg->msg_flags & MSG_DONTWAIT, &err);
        if (!skb)
-               return ERR_PTR(-ENOMEM);
+               return ERR_PTR(err);
 
        /* Create L2CAP header */
        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1934,6 +1951,9 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
 
        release_sock(sk);
 
+       if (sock->type == SOCK_STREAM)
+               return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+
        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 }
 
@@ -3151,6 +3171,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
                u8 buf[64];
+               l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                        l2cap_build_conf_req(sk, buf), buf);
                l2cap_pi(sk)->num_conf_req++;
@@ -4643,6 +4664,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
 
        if (flags & ACL_START) {
                struct l2cap_hdr *hdr;
+               struct sock *sk;
+               u16 cid;
                int len;
 
                if (conn->rx_len) {
@@ -4653,7 +4676,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                        l2cap_conn_unreliable(conn, ECOMM);
                }
 
-               if (skb->len < 2) {
+               /* Start fragment always begin with Basic L2CAP header */
+               if (skb->len < L2CAP_HDR_SIZE) {
                        BT_ERR("Frame is too short (len %d)", skb->len);
                        l2cap_conn_unreliable(conn, ECOMM);
                        goto drop;
@@ -4661,6 +4685,7 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
 
                hdr = (struct l2cap_hdr *) skb->data;
                len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
+               cid = __le16_to_cpu(hdr->cid);
 
                if (len == skb->len) {
                        /* Complete frame received */
@@ -4677,6 +4702,19 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                        goto drop;
                }
 
+               sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
+
+               if (sk && l2cap_pi(sk)->imtu < len - L2CAP_HDR_SIZE) {
+                       BT_ERR("Frame exceeding recv MTU (len %d, MTU %d)",
+                                       len, l2cap_pi(sk)->imtu);
+                       bh_unlock_sock(sk);
+                       l2cap_conn_unreliable(conn, ECOMM);
+                       goto drop;
+               }
+
+               if (sk)
+                       bh_unlock_sock(sk);
+
                /* Allocate skb for the complete frame (with header) */
                conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
                if (!conn->rx_skb)