diff options
Diffstat (limited to 'kernel/net/bluetooth')
| -rw-r--r-- | kernel/net/bluetooth/l2cap_sock.c | 2 | ||||
| -rw-r--r-- | kernel/net/bluetooth/mgmt.c | 4 |
2 files changed, 5 insertions, 1 deletions
diff --git a/kernel/net/bluetooth/l2cap_sock.c b/kernel/net/bluetooth/l2cap_sock.c index 1bb551527..d9bbbded4 100644 --- a/kernel/net/bluetooth/l2cap_sock.c +++ b/kernel/net/bluetooth/l2cap_sock.c @@ -927,7 +927,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (get_user(opt, (u32 __user *) optval)) { + if (get_user(opt, (u16 __user *) optval)) { err = -EFAULT; break; } diff --git a/kernel/net/bluetooth/mgmt.c b/kernel/net/bluetooth/mgmt.c index 7f2211927..b1b0a1c0b 100644 --- a/kernel/net/bluetooth/mgmt.c +++ b/kernel/net/bluetooth/mgmt.c @@ -7155,6 +7155,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev, return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, status); + if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, + MGMT_STATUS_INVALID_PARAMS); + flags = __le32_to_cpu(cp->flags); timeout = __le16_to_cpu(cp->timeout); duration = __le16_to_cpu(cp->duration); |