summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorAlex Shi <alex.shi@linaro.org>2016-04-13 12:02:21 +0800
committerAlex Shi <alex.shi@linaro.org>2016-04-13 12:02:21 +0800
commit08562bfcb85748c69e5824fc6d1d77d5725787e4 (patch)
tree905e39ccad43e244dbb09d4eccce1c91e0facce0 /net
parent9fe9bdd75b2ad9ed25152fce02f41fe63c542e8a (diff)
parentad592b70ae97800d4f5bf535d45a680649e2789e (diff)
Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/mgmt.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7f22119276f3..b1b0a1c0bd8d 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7155,6 +7155,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev,
return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
status);
+ if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+ MGMT_STATUS_INVALID_PARAMS);
+
flags = __le32_to_cpu(cp->flags);
timeout = __le16_to_cpu(cp->timeout);
duration = __le16_to_cpu(cp->duration);