diff options
| author | David S. Miller <davem@davemloft.net> | 2011-07-14 07:56:40 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-07-14 07:56:40 -0700 |
| commit | 6a7ebdf2fd15417e87b4fd02ff411aeaca34da5f (patch) | |
| tree | 86b15d8cd3e25c97b348b5a61bdb16c02726a480 /net/bluetooth/l2cap_core.c | |
| parent | f6b72b6217f8c24f2a54988e58af858b4e66024d (diff) | |
| parent | 51414d41084496aaefd06d7f19eb8206e8bfac2d (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
net/bluetooth/l2cap_core.c
Diffstat (limited to 'net/bluetooth/l2cap_core.c')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 9ec9c8c5eb5..fc219ec2871 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -2530,7 +2530,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr sk = chan->sk; - if (chan->state != BT_CONFIG) { + if ((bt_sk(sk)->defer_setup && chan->state != BT_CONNECT2) || + (!bt_sk(sk)->defer_setup && chan->state != BT_CONFIG)) { struct l2cap_cmd_rej rej; rej.reason = cpu_to_le16(0x0002); @@ -2541,7 +2542,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr /* Reject if config buffer is too small. */ len = cmd_len - sizeof(*req); - if (chan->conf_len + len > sizeof(chan->conf_req)) { + if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) { l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp(chan, rsp, L2CAP_CONF_REJECT, flags), rsp); |