summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohan Hedberg <johan.hedberg@intel.com>2013-01-09 15:29:35 +0200
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>2013-01-10 06:09:07 -0200
commit575b3a02e20a10bb8110378ef363a8a174018680 (patch)
tree677812b750e51e31090123be2320267d74582476
parent715a5bf2db4df4a7df64f420d21fb49ba146b3fa (diff)
downloadop-kernel-dev-575b3a02e20a10bb8110378ef363a8a174018680.zip
op-kernel-dev-575b3a02e20a10bb8110378ef363a8a174018680.tar.gz
Bluetooth: Fix checking for valid device class values
The two lowest bits of the minor device class value are reserved and should be zero, and the three highest bits of the major device class likewise. The management code should therefore test for this and return a proper "invalid params" error if the condition is not met. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-rw-r--r--net/bluetooth/mgmt.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1dd41d4..f3fec42 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1430,6 +1430,12 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
goto unlock;
}
+ if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
+ err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+ MGMT_STATUS_INVALID_PARAMS);
+ goto unlock;
+ }
+
hdev->major_class = cp->major;
hdev->minor_class = cp->minor;
OpenPOWER on IntegriCloud