Commit bb77543e authored by Marcel Holtmann's avatar Marcel Holtmann
Browse files

Bluetooth: Restrict valid packet types via HCI_CHANNEL_RAW 



When using the HCI_CHANNEL_RAW, restrict the packet types to valid ones
from the Bluetooth specification.

Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
parent 8cd4f581

net/bluetooth/hci_sock.c

+11 −0
Original line number Diff line number Diff line
@@ -170,6 +170,11 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 
			continue;



		if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {

			if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&

			    bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&

			    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&

			    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT)

				continue;

			if (is_filtered_packet(sk, skb))

				continue;

		} else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
@@ -1247,6 +1252,12 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 
			goto drop;

		}



		if (bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&

		    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {

			err = -EINVAL;

			goto drop;

		}



		skb_queue_tail(&hdev->raw_q, skb);

		queue_work(hdev->workqueue, &hdev->tx_work);

	}