Commit c19a495c authored by Johan Hedberg's avatar Johan Hedberg Committed by Marcel Holtmann

Bluetooth: Fix BR/EDR-only address checks for remote OOB data

For now the mgmt commands dealing with remote OOB data are strictly
BR/EDR-only. This patch fixes missing checks for the passed address type
so that any non-BR/EDR value triggers the appropriate error response.
Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent ee7b9053
...@@ -3589,6 +3589,14 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, ...@@ -3589,6 +3589,14 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
struct mgmt_cp_add_remote_oob_data *cp = data; struct mgmt_cp_add_remote_oob_data *cp = data;
u8 status; u8 status;
if (cp->addr.type != BDADDR_BREDR) {
err = cmd_complete(sk, hdev->id,
MGMT_OP_ADD_REMOTE_OOB_DATA,
MGMT_STATUS_INVALID_PARAMS,
&cp->addr, sizeof(cp->addr));
goto unlock;
}
err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
cp->hash, cp->randomizer); cp->hash, cp->randomizer);
if (err < 0) if (err < 0)
...@@ -3602,6 +3610,14 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, ...@@ -3602,6 +3610,14 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
struct mgmt_cp_add_remote_oob_ext_data *cp = data; struct mgmt_cp_add_remote_oob_ext_data *cp = data;
u8 status; u8 status;
if (cp->addr.type != BDADDR_BREDR) {
err = cmd_complete(sk, hdev->id,
MGMT_OP_ADD_REMOTE_OOB_DATA,
MGMT_STATUS_INVALID_PARAMS,
&cp->addr, sizeof(cp->addr));
goto unlock;
}
err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr, err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
cp->hash192, cp->hash192,
cp->randomizer192, cp->randomizer192,
...@@ -3620,6 +3636,7 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, ...@@ -3620,6 +3636,7 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
MGMT_STATUS_INVALID_PARAMS); MGMT_STATUS_INVALID_PARAMS);
} }
unlock:
hci_dev_unlock(hdev); hci_dev_unlock(hdev);
return err; return err;
} }
...@@ -3633,6 +3650,11 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, ...@@ -3633,6 +3650,11 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
BT_DBG("%s", hdev->name); BT_DBG("%s", hdev->name);
if (cp->addr.type != BDADDR_BREDR)
return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
MGMT_STATUS_INVALID_PARAMS,
&cp->addr, sizeof(cp->addr));
hci_dev_lock(hdev); hci_dev_lock(hdev);
if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment