Merge tag 'integrity-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar...

[linux-2.6-microblaze.git] / net / bluetooth / l2cap_core.c

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 72c2f52..b6a88b8 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -451,6 +451,8 @@ struct l2cap_chan *l2cap_chan_create(void)
        if (!chan)
                return NULL;
 
+       skb_queue_head_init(&chan->tx_q);
+       skb_queue_head_init(&chan->srej_q);
        mutex_init(&chan->lock);
 
        /* Set default lock nesting level */
@@ -490,14 +492,14 @@ static void l2cap_chan_destroy(struct kref *kref)
 
 void l2cap_chan_hold(struct l2cap_chan *c)
 {
-       BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref));
+       BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
 
        kref_get(&c->kref);
 }
 
 void l2cap_chan_put(struct l2cap_chan *c)
 {
-       BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref));
+       BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
 
        kref_put(&c->kref, l2cap_chan_destroy);
 }
@@ -516,7 +518,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan)
        chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
        chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
        chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+
        chan->conf_state = 0;
+       set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
 
        set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 }
@@ -648,7 +652,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
        if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
                return;
 
-       switch(chan->mode) {
+       switch (chan->mode) {
        case L2CAP_MODE_BASIC:
                break;
 
@@ -672,8 +676,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
                skb_queue_purge(&chan->tx_q);
                break;
        }
-
-       return;
 }
 EXPORT_SYMBOL_GPL(l2cap_chan_del);
 
@@ -1690,7 +1692,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
                smp_conn_security(hcon, hcon->pending_sec_level);
 
        /* For LE slave connections, make sure the connection interval
-        * is in the range of the minium and maximum interval that has
+        * is in the range of the minimum and maximum interval that has
         * been configured for this connection. If not, then trigger
         * the connection update procedure.
         */
@@ -5921,7 +5923,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
        struct l2cap_ecred_conn_req *req = (void *) data;
        struct {
                struct l2cap_ecred_conn_rsp rsp;
-               __le16 dcid[5];
+               __le16 dcid[L2CAP_ECRED_MAX_CID];
        } __packed pdu;
        struct l2cap_chan *chan, *pchan;
        u16 mtu, mps;
@@ -5938,6 +5940,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
                goto response;
        }
 
+       cmd_len -= sizeof(*req);
+       num_scid = cmd_len / sizeof(u16);
+
+       if (num_scid > ARRAY_SIZE(pdu.dcid)) {
+               result = L2CAP_CR_LE_INVALID_PARAMS;
+               goto response;
+       }
+
        mtu  = __le16_to_cpu(req->mtu);
        mps  = __le16_to_cpu(req->mps);
 
@@ -5970,8 +5980,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
        }
 
        result = L2CAP_CR_LE_SUCCESS;
-       cmd_len -= sizeof(*req);
-       num_scid = cmd_len / sizeof(u16);
 
        for (i = 0; i < num_scid; i++) {
                u16 scid = __le16_to_cpu(req->scid[i]);
@@ -7253,7 +7261,7 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
            L2CAP_TXSEQ_EXPECTED) {
                l2cap_pass_to_tx(chan, control);
 
-               BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
+               BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
                       __next_seq(chan, chan->buffer_seq));
 
                chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
@@ -7542,7 +7550,7 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
        BT_DBG("chan %p, len %d", chan, skb->len);
 
        /* If we receive data on a fixed channel before the info req/rsp
-        * procdure is done simply assume that the channel is supported
+        * procedure is done simply assume that the channel is supported
         * and mark it as ready.
         */
        if (chan->chan_type == L2CAP_CHAN_FIXED)
@@ -7762,7 +7770,8 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
        return conn;
 }
 
-static bool is_valid_psm(u16 psm, u8 dst_type) {
+static bool is_valid_psm(u16 psm, u8 dst_type)
+{
        if (!psm)
                return false;
 
@@ -8356,7 +8365,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
        if (!conn)
                goto drop;
 
-       BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
+       BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
        switch (flags) {
        case ACL_START:
@@ -8386,10 +8395,10 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
                        return;
                }
 
-               BT_DBG("Start: total len %d, frag len %d", len, skb->len);
+               BT_DBG("Start: total len %d, frag len %u", len, skb->len);
 
                if (skb->len > len) {
-                       BT_ERR("Frame is too long (len %d, expected len %d)",
+                       BT_ERR("Frame is too long (len %u, expected len %d)",
                               skb->len, len);
                        l2cap_conn_unreliable(conn, ECOMM);
                        goto drop;
@@ -8402,7 +8411,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
                break;
 
        case ACL_CONT:
-               BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
+               BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
 
                if (!conn->rx_skb) {
                        BT_ERR("Unexpected continuation frame (len %d)", skb->len);
@@ -8423,7 +8432,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
                }
 
                if (skb->len > conn->rx_len) {
-                       BT_ERR("Fragment is too long (len %d, expected %d)",
+                       BT_ERR("Fragment is too long (len %u, expected %u)",
                               skb->len, conn->rx_len);
                        l2cap_recv_reset(conn);
                        l2cap_conn_unreliable(conn, ECOMM);