From: Ville Tervo <ville.tervo@nokia.com>
Date: Wed, 4 Aug 2010 06:43:33 +0000 (+0300)
Subject: Bluetooth: Check result code of L2CAP information response
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=adb08edea0119f7a5484a9f6a385fbcecdf85a63;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

Bluetooth: Check result code of L2CAP information response

Check result code of L2CAP information response. Otherwise
it would read invalid feature mask and access invalid memory.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 0f34e1275147..3e3cd9d4e52c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3348,6 +3348,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
 	del_timer(&conn->info_timer);
 
+	if (result != L2CAP_IR_SUCCESS) {
+		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+		conn->info_ident = 0;
+
+		l2cap_conn_start(conn);
+
+		return 0;
+	}
+
 	if (type == L2CAP_IT_FEAT_MASK) {
 		conn->feat_mask = get_unaligned_le32(rsp->data);