1 files changed, 25 insertions, 23 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 670ff95ca64b..c4e4ce4ebb2b 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -353,7 +353,7 @@ static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16
 }
 
 /* ---- Socket interface ---- */
-static struct sock *__l2cap_get_sock_by_addr(u16 psm, bdaddr_t *src)
+static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 {
         struct sock *sk;
         struct hlist_node *node;
@@ -368,7 +368,7 @@ found:
 /* Find socket with psm and source bdaddr.
  * Returns closest match.
  */
-static struct sock *__l2cap_get_sock_by_psm(int state, u16 psm, bdaddr_t *src)
+static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
         struct hlist_node *node;
@@ -392,7 +392,7 @@ static struct sock *__l2cap_get_sock_by_psm(int state, u16 psm, bdaddr_t *src)
 
 /* Find socket with given address (psm, src).
  * Returns locked socket */
-static inline struct sock *l2cap_get_sock_by_psm(int state, u16 psm, bdaddr_t *src)
+static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 {
         struct sock *s;
         read_lock(&l2cap_sk_list.lock);
@@ -586,7 +586,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_
                 goto done;
         }
 
-        if (la->l2_psm > 0 && btohs(la->l2_psm) < 0x1001 &&
+        if (la->l2_psm && btohs(la->l2_psm) < 0x1001 &&
                                 !capable(CAP_NET_BIND_SERVICE)) {
                 err = -EACCES;
                 goto done;
@@ -748,7 +748,7 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
                 write_lock_bh(&l2cap_sk_list.lock);
 
                 for (psm = 0x1001; psm < 0x1100; psm += 2)
-                        if (!__l2cap_get_sock_by_addr(psm, src)) {
+                        if (!__l2cap_get_sock_by_addr(htobs(psm), src)) {
                                 l2cap_pi(sk)->psm   = htobs(psm);
                                 l2cap_pi(sk)->sport = htobs(psm);
                                 err = 0;
@@ -873,7 +873,7 @@ static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
 
         if (sk->sk_type == SOCK_DGRAM)
-                put_unaligned(l2cap_pi(sk)->psm, (u16 *) skb_put(skb, 2));
+                put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
 
         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
                 err = -EFAULT;
@@ -1256,11 +1256,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                 break;
 
         case 2:
-                *val = __le16_to_cpu(*((u16 *)opt->val));
+                *val = __le16_to_cpu(*((__le16 *)opt->val));
                 break;
 
         case 4:
-                *val = __le32_to_cpu(*((u32 *)opt->val));
+                *val = __le32_to_cpu(*((__le32 *)opt->val));
                 break;
 
         default:
@@ -1287,11 +1287,11 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
                 break;
 
         case 2:
-                *((u16 *) opt->val) = cpu_to_le16(val);
+                *((__le16 *) opt->val) = cpu_to_le16(val);
                 break;
 
         case 4:
-                *((u32 *) opt->val) = cpu_to_le32(val);
+                *((__le32 *) opt->val) = cpu_to_le32(val);
                 break;
 
         default:
@@ -1406,7 +1406,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         int result = 0, status = 0;
 
         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
-        u16 psm  = req->psm;
+        __le16 psm  = req->psm;
 
         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
 
@@ -1530,7 +1530,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         return 0;
 }
 
-static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
         u16 dcid, flags;
@@ -1550,7 +1550,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         /* Reject if config buffer is too small. */
-        len = cmd->len - sizeof(*req);
+        len = cmd_len - sizeof(*req);
         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                 l2cap_build_conf_rsp(sk, rsp,
@@ -1748,15 +1748,16 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
         l2cap_raw_recv(conn, skb);
 
         while (len >= L2CAP_CMD_HDR_SIZE) {
+                u16 cmd_len;
                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
                 data += L2CAP_CMD_HDR_SIZE;
                 len  -= L2CAP_CMD_HDR_SIZE;
 
-                cmd.len = __le16_to_cpu(cmd.len);
+                cmd_len = le16_to_cpu(cmd.len);
 
-                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd.len, cmd.ident);
+                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
 
-                if (cmd.len > len || !cmd.ident) {
+                if (cmd_len > len || !cmd.ident) {
                         BT_DBG("corrupted command");
                         break;
                 }
@@ -1775,7 +1776,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
                         break;
 
                 case L2CAP_CONF_REQ:
-                        err = l2cap_config_req(conn, &cmd, data);
+                        err = l2cap_config_req(conn, &cmd, cmd_len, data);
                         break;
 
                 case L2CAP_CONF_RSP:
@@ -1791,7 +1792,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
                         break;
 
                 case L2CAP_ECHO_REQ:
-                        l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd.len, data);
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
                         break;
 
                 case L2CAP_ECHO_RSP:
@@ -1820,8 +1821,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
                 }
 
-                data += cmd.len;
-                len  -= cmd.len;
+                data += cmd_len;
+                len  -= cmd_len;
         }
 
         kfree_skb(skb);
@@ -1863,7 +1864,7 @@ done:
         return 0;
 }
 
-static inline int l2cap_conless_channel(struct l2cap_conn *conn, u16 psm, struct sk_buff *skb)
+static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
 {
         struct sock *sk;
 
@@ -1893,7 +1894,8 @@ done:
 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct l2cap_hdr *lh = (void *) skb->data;
-        u16 cid, psm, len;
+        u16 cid, len;
+        __le16 psm;
 
         skb_pull(skb, L2CAP_HDR_SIZE);
         cid = __le16_to_cpu(lh->cid);
@@ -1907,7 +1909,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case 0x0002:
-                psm = get_unaligned((u16 *) skb->data);
+                psm = get_unaligned((__le16 *) skb->data);
                 skb_pull(skb, 2);
                 l2cap_conless_channel(conn, psm, skb);
                 break;