Merge tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...

[linux-2.6-block.git] / net / bluetooth / cmtp / core.c

diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 278a194e6af488f67197c3725ca937f554989498..298ed37010e691a6f2bb72c506b6e50f9e8676f9 100644 (file)
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -75,10 +75,11 @@ static void __cmtp_unlink_session(struct cmtp_session *session)
 
 static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
 {
+       u32 valid_flags = BIT(CMTP_LOOPBACK);
        memset(ci, 0, sizeof(*ci));
        bacpy(&ci->bdaddr, &session->bdaddr);
 
-       ci->flags = session->flags;
+       ci->flags = session->flags & valid_flags;
        ci->state = session->state;
 
        ci->num = session->num;
@@ -313,7 +314,7 @@ static int cmtp_session(void *arg)
 
        down_write(&cmtp_session_sem);
 
-       if (!(session->flags & (1 << CMTP_LOOPBACK)))
+       if (!(session->flags & BIT(CMTP_LOOPBACK)))
                cmtp_detach_device(session);
 
        fput(session->sock->file);
@@ -329,6 +330,7 @@ static int cmtp_session(void *arg)
 
 int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 {
+       u32 valid_flags = BIT(CMTP_LOOPBACK);
        struct cmtp_session *session, *s;
        int i, err;
 
@@ -337,6 +339,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
        if (!l2cap_is_socket(sock))
                return -EBADFD;
 
+       if (req->flags & ~valid_flags)
+               return -EINVAL;
+
        session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
        if (!session)
                return -ENOMEM;
@@ -385,7 +390,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
                goto unlink;
        }
 
-       if (!(session->flags & (1 << CMTP_LOOPBACK))) {
+       if (!(session->flags & BIT(CMTP_LOOPBACK))) {
                err = cmtp_attach_device(session);
                if (err < 0) {
                        atomic_inc(&session->terminate);
@@ -409,11 +414,15 @@ failed:
 
 int cmtp_del_connection(struct cmtp_conndel_req *req)
 {
+       u32 valid_flags = 0;
        struct cmtp_session *session;
        int err = 0;
 
        BT_DBG("");
 
+       if (req->flags & ~valid_flags)
+               return -EINVAL;
+
        down_read(&cmtp_session_sem);
 
        session = __cmtp_get_session(&req->bdaddr);