[BLUETOOTH]: Fix unaligned access in hci_send_to_sock.

[linux-drm-fsl-dcu.git] / net / bluetooth / hci_sock.c

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 84e6c93a044ad50e934fe8aaa008b4e48354d0fc..711a085eca5b3436bc13e528a7b03904f74beba2 100644 (file)
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -24,10 +24,10 @@
 
 /* Bluetooth HCI sockets. */
 
-#include <linux/config.h>
 #include <linux/module.h>
 
 #include <linux/types.h>
+#include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
@@ -120,10 +120,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                        if (!hci_test_bit(evt, &flt->event_mask))
                                continue;
 
-                       if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
-                                       flt->opcode != *(__u16 *)(skb->data + 3)) ||
-                                       (evt == HCI_EV_CMD_STATUS && 
-                                       flt->opcode != *(__u16 *)(skb->data + 4))))
+                       if (flt->opcode &&
+                           ((evt == HCI_EV_CMD_COMPLETE &&
+                             flt->opcode !=
+                             get_unaligned((__u16 *)(skb->data + 3))) ||
+                            (evt == HCI_EV_CMD_STATUS &&
+                             flt->opcode !=
+                             get_unaligned((__u16 *)(skb->data + 4)))))
                                continue;
                }
 
@@ -142,13 +145,15 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 static int hci_sock_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
-       struct hci_dev *hdev = hci_pi(sk)->hdev;
+       struct hci_dev *hdev;
 
        BT_DBG("sock %p sk %p", sock, sk);
 
        if (!sk)
                return 0;
 
+       hdev = hci_pi(sk)->hdev;
+
        bt_sock_unlink(&hci_sk_list, sk);
 
        if (hdev) {
@@ -310,14 +315,18 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *add
 {
        struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
        struct sock *sk = sock->sk;
+       struct hci_dev *hdev = hci_pi(sk)->hdev;
 
        BT_DBG("sock %p sk %p", sock, sk);
 
+       if (!hdev)
+               return -EBADFD;
+
        lock_sock(sk);
 
        *addr_len = sizeof(*haddr);
        haddr->hci_family = AF_BLUETOOTH;
-       haddr->hci_dev    = hci_pi(sk)->hdev->id;
+       haddr->hci_dev    = hdev->id;
 
        release_sock(sk);
        return 0;
@@ -612,7 +621,7 @@ static int hci_sock_create(struct socket *sock, int protocol)
 
        sock->ops = &hci_sock_ops;
 
-       sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
+       sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
        if (!sk)
                return -ENOMEM;