Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02d6a746 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 



Johan Hedberg says:

====================
pull request: bluetooth 2014-12-19

Here's one more pull request for 3.19. It contains the socket type
verification fixes from Al Viro as well as an skb double-free fix for
6lowpan from Jukka Rissanen.

Please let me know if there are any issues pulling. Thanks.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 17e96834 71bb99a0

net/bluetooth/6lowpan.c

+0 −1
Original line number Diff line number Diff line
@@ -390,7 +390,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev, 


drop:

	dev->stats.rx_dropped++;

	kfree_skb(skb);

	return NET_RX_DROP;

}

net/bluetooth/bnep/core.c

+3 −0
Original line number Diff line number Diff line
@@ -533,6 +533,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) 


	BT_DBG("");



	if (!l2cap_is_socket(sock))

		return -EBADFD;



	baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);

	baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);

net/bluetooth/cmtp/core.c

+3 −0
Original line number Diff line number Diff line
@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) 


	BT_DBG("");



	if (!l2cap_is_socket(sock))

		return -EBADFD;



	session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);

	if (!session)

		return -ENOMEM;

net/bluetooth/hidp/core.c

+2 −1
Original line number Diff line number Diff line
@@ -1314,13 +1314,14 @@ int hidp_connection_add(struct hidp_connadd_req *req, 
{

	struct hidp_session *session;

	struct l2cap_conn *conn;

	struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan;

	struct l2cap_chan *chan;

	int ret;



	ret = hidp_verify_sockets(ctrl_sock, intr_sock);

	if (ret)

		return ret;



	chan = l2cap_pi(ctrl_sock->sk)->chan;

	conn = NULL;

	l2cap_chan_lock(chan);

	if (chan->conn)