diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-05-30 19:15:58 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-05-30 19:15:58 -0700 |
| commit | d1a866d5530698a4be4214048c2282c7e5bfcdac (patch) | |
| tree | 71ac54033850d4aa995c69fb52bff7dfcc562c9f /net | |
| parent | net: usb: aqc111: debug info before sanitation (diff) | |
| parent | Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (diff) | |
| download | linux-d1a866d5530698a4be4214048c2282c7e5bfcdac.tar.gz linux-d1a866d5530698a4be4214048c2282c7e5bfcdac.zip | |
Merge tag 'for-net-2025-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_qca: move the SoC type check to the right place
- MGMT: reject malformed HCI_CMD_SYNC commands
- btnxpuart: Fix missing devm_request_irq() return value check
- L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
* tag 'for-net-2025-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
Bluetooth: hci_qca: move the SoC type check to the right place
Bluetooth: btnxpuart: Fix missing devm_request_irq() return value check
Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
====================
Link: https://patch.msgid.link/20250530174835.405726-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 3 | ||||
| -rw-r--r-- | net/bluetooth/mgmt.c | 3 |
2 files changed, 4 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 042d3ac3b4a3..a5bde5db58ef 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4870,7 +4870,8 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, if (!smp_sufficient_security(conn->hcon, pchan->sec_level, SMP_ALLOW_STK)) { - result = L2CAP_CR_LE_AUTHENTICATION; + result = pchan->sec_level == BT_SECURITY_MEDIUM ? + L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; chan = NULL; goto response_unlock; } diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 261926dccc7e..14a9462fced5 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2566,7 +2566,8 @@ static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, struct mgmt_pending_cmd *cmd; int err; - if (len < sizeof(*cp)) + if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + + le16_to_cpu(cp->params_len))) return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, MGMT_STATUS_INVALID_PARAMS); |