[PATCH 1/5] Bluetooth: Check SOL_HCI for raw socket options

[PATCH 1/5] Bluetooth: Check SOL_HCI for raw socket options

[Marcel Holtmann]

The SOL_HCI level should be enforced when using socket options on the
HCI raw socket interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---
 net/bluetooth/hci_sock.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 96f04b7b9556..99dd1503ef56 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1440,6 +1440,9 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
 
 	BT_DBG("sk %p, opt %d", sk, optname);
 
+	if (level != SOL_HCI)
+		return -ENOPROTOOPT;
+
 	lock_sock(sk);
 
 	if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
@@ -1523,6 +1526,9 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
 
 	BT_DBG("sk %p, opt %d", sk, optname);
 
+	if (level != SOL_HCI)
+		return -ENOPROTOOPT;
+
 	if (get_user(len, optlen))
 		return -EFAULT;
 
-- 
2.7.4

Re: [PATCH 1/5] Bluetooth: Check SOL_HCI for raw socket options

[Johan Hedberg]

Hi Marcel,

On Sat, Aug 27, 2016, Marcel Holtmann wrote:
> The SOL_HCI level should be enforced when using socket options on the
> HCI raw socket interface.
> 
> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
> ---
>  net/bluetooth/hci_sock.c | 6 ++++++
>  1 file changed, 6 insertions(+)

All five patches in this set have been applied to bluetooth-next. They
seem to work quite nicely with the latest btmon in bluez.git.

Johan