---

yaml --- r: 134722 b: refs/heads/master c: 0588d94 h: refs/heads/master v: v3
git-mirror · Feb 27, 2009 · 26862a6 · 26862a6
1 parent ec022f8
commit 26862a6
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: f62e4323ab43c59e7cd7f72c1eb392d7c767ce5a
+refs/heads/master: 0588d94fd7e414367a7ae517569d2222441c255f
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
@@ -1248,10 +1248,18 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 	if (level == SOL_L2CAP)
 		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 
+	if (level != SOL_BLUETOOTH)
+		return -ENOPROTOOPT;
+
 	lock_sock(sk);
 
 	switch (optname) {
 	case BT_SECURITY:
+		if (sk->sk_type != SOCK_SEQPACKET) {
+			err = -EINVAL;
+			break;
+		}
+
 		sec.level = BT_SECURITY_LOW;
 
 		len = min_t(unsigned int, sizeof(sec), optlen);
@@ -1384,13 +1392,21 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 	if (level == SOL_L2CAP)
 		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 
+	if (level != SOL_BLUETOOTH)
+		return -ENOPROTOOPT;
+
 	if (get_user(len, optlen))
 		return -EFAULT;
 
 	lock_sock(sk);
 
 	switch (optname) {
 	case BT_SECURITY:
+		if (sk->sk_type != SOCK_SEQPACKET) {
+			err = -EINVAL;
+			break;
+		}
+
 		sec.level = l2cap_pi(sk)->sec_level;
 
 		len = min_t(unsigned int, len, sizeof(sec));

diff --git a/trunk/net/bluetooth/rfcomm/sock.c b/trunk/net/bluetooth/rfcomm/sock.c
@@ -778,10 +778,18 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 	if (level == SOL_RFCOMM)
 		return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 
+	if (level != SOL_BLUETOOTH)
+		return -ENOPROTOOPT;
+
 	lock_sock(sk);
 
 	switch (optname) {
 	case BT_SECURITY:
+		if (sk->sk_type != SOCK_STREAM) {
+			err = -EINVAL;
+			break;
+		}
+
 		sec.level = BT_SECURITY_LOW;
 
 		len = min_t(unsigned int, sizeof(sec), optlen);
@@ -899,13 +907,21 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
 	if (level == SOL_RFCOMM)
 		return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 
+	if (level != SOL_BLUETOOTH)
+		return -ENOPROTOOPT;
+
 	if (get_user(len, optlen))
 		return -EFAULT;
 
 	lock_sock(sk);
 
 	switch (optname) {
 	case BT_SECURITY:
+		if (sk->sk_type != SOCK_STREAM) {
+			err = -EINVAL;
+			break;
+		}
+
 		sec.level = rfcomm_pi(sk)->sec_level;
 
 		len = min_t(unsigned int, len, sizeof(sec));