Commit 54ad6d8a authored Jan 20, 2013 by Johan Hedberg Committed by Gustavo Padovan Jan 23, 2013

Bluetooth: Fix checking for proper key->master value in Load LTKs

The allowed values for the key->master parameter in the Load LTKs
command are 0x00 and 0x01. If there is a key in the list with some other
value the command should fail with a proper invalid params response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

parent e57e619f

net/bluetooth/mgmt.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -2721,6 +2721,15 @@ static int load_long_term_keys(struct sock sk, struct hci_dev hdev,

		BT_DBG("%s key_count %u", hdev->name, key_count);

		for (i = 0; i < key_count; i++) {
		struct mgmt_ltk_info *key = &cp->keys[i];

		if (key->master != 0x00 && key->master != 0x01)
		return cmd_status(sk, hdev->id,
		MGMT_OP_LOAD_LONG_TERM_KEYS,
		MGMT_STATUS_INVALID_PARAMS);
		}

		hci_dev_lock(hdev);

		hci_smp_ltks_clear(hdev);