Commit fe806dce authored Oct 08, 2015 by Marcel Holtmann Committed by Johan Hedberg Oct 08, 2015

Bluetooth: Enforce packet types in hci_recv_frame driver function

When calling the hci_recv_frame driver function check for valid packet
types that the core should process. This should catch issues with
drivers trying to feed vendor packet types through this interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

parent 943cc592

net/bluetooth/hci_core.c

+7 −0

Original line number	Original line	Diff line number	Diff line
	@@ -3538,6 +3538,13 @@ int hci_recv_frame(struct hci_dev hdev, struct sk_buff skb)
	return -ENXIO;		return -ENXIO;
	}		}

			if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
			bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
			bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
			kfree_skb(skb);
			return -EINVAL;
			}

	/* Incoming skb */		/* Incoming skb */
	bt_cb(skb)->incoming = 1;		bt_cb(skb)->incoming = 1;