Bluetooth: Check SOL_HCI for raw socket options
authorMarcel Holtmann <marcel@holtmann.org>
Sat, 27 Aug 2016 18:23:37 +0000 (20:23 +0200)
committerMarcel Holtmann <marcel@holtmann.org>
Mon, 19 Sep 2016 18:19:34 +0000 (20:19 +0200)
The SOL_HCI level should be enforced when using socket options on the
HCI raw socket interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
net/bluetooth/hci_sock.c

index 96f04b7b9556d020a64402179eecdf79f547e162..99dd1503ef567e76629a557772ea62266197e91f 100644 (file)
@@ -1440,6 +1440,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 
        BT_DBG("sk %p, opt %d", sk, optname);
 
+       if (level != SOL_HCI)
+               return -ENOPROTOOPT;
+
        lock_sock(sk);
 
        if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
@@ -1523,6 +1526,9 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
 
        BT_DBG("sk %p, opt %d", sk, optname);
 
+       if (level != SOL_HCI)
+               return -ENOPROTOOPT;
+
        if (get_user(len, optlen))
                return -EFAULT;