From adb08edea0119f7a5484a9f6a385fbcecdf85a63 Mon Sep 17 00:00:00 2001 From: Ville Tervo Date: Wed, 4 Aug 2010 09:43:33 +0300 Subject: Bluetooth: Check result code of L2CAP information response Check result code of L2CAP information response. Otherwise it would read invalid feature mask and access invalid memory. Signed-off-by: Ville Tervo Signed-off-by: Marcel Holtmann --- net/bluetooth/l2cap.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'net/bluetooth') diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 0f34e1275147..3e3cd9d4e52c 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c @@ -3348,6 +3348,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm del_timer(&conn->info_timer); + if (result != L2CAP_IR_SUCCESS) { + conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; + conn->info_ident = 0; + + l2cap_conn_start(conn); + + return 0; + } + if (type == L2CAP_IT_FEAT_MASK) { conn->feat_mask = get_unaligned_le32(rsp->data); -- cgit v1.2.3