From: Loic Poulain <loic.poulain@intel.com>
Date: Wed, 2 Sep 2015 10:04:14 +0000 (+0200)
Subject: Bluetooth: hci_intel: Show error in case of invalid LPM packet size
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=1b1975749f856946f716180ca94db52fb1ae3500;p=deliverable%2Flinux.git

Bluetooth: hci_intel: Show error in case of invalid LPM packet size

Don't hide this packet size error.

Signed-off-by: Loic Poulain <loic.poulain@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---

diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 9fd1143bc78f..b4dc3c5b3841 100644
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -1010,8 +1010,11 @@ static int intel_recv_lpm(struct hci_dev *hdev, struct sk_buff *skb)
 
 	switch (lpm->opcode) {
 	case LPM_OP_TX_NOTIFY:
-		if (lpm->dlen)
-			intel_recv_lpm_notify(hdev, lpm->data[0]);
+		if (lpm->dlen < 1) {
+			bt_dev_err(hu->hdev, "Invalid LPM notification packet");
+			break;
+		}
+		intel_recv_lpm_notify(hdev, lpm->data[0]);
 		break;
 	case LPM_OP_SUSPEND_ACK:
 		set_bit(STATE_SUSPENDED, &intel->flags);