summaryrefslogtreecommitdiffstats
path: root/net/bluetooth
diff options
context:
space:
mode:
authorVille Tervo <ville.tervo@nokia.com>2010-08-04 09:43:33 +0300
committerMarcel Holtmann <marcel@holtmann.org>2010-08-04 07:25:17 -0700
commitadb08edea0119f7a5484a9f6a385fbcecdf85a63 (patch)
tree32b623c88a568b6a6539adf2196f816b9ed650df /net/bluetooth
parent6340650400525a9ca8d86b1b4501cc50670dce0d (diff)
downloadlinux-adb08edea0119f7a5484a9f6a385fbcecdf85a63.tar.bz2
Bluetooth: Check result code of L2CAP information response
Check result code of L2CAP information response. Otherwise it would read invalid feature mask and access invalid memory. Signed-off-by: Ville Tervo <ville.tervo@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/l2cap.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 0f34e1275147..3e3cd9d4e52c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3348,6 +3348,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
del_timer(&conn->info_timer);
+ if (result != L2CAP_IR_SUCCESS) {
+ conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+ conn->info_ident = 0;
+
+ l2cap_conn_start(conn);
+
+ return 0;
+ }
+
if (type == L2CAP_IT_FEAT_MASK) {
conn->feat_mask = get_unaligned_le32(rsp->data);