1 files changed, 26 insertions, 7 deletions

diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 3c2d3e4aa2f5..c024e715512f 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -105,13 +105,18 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 }
 
 /* ---- Socket functions ---- */
-static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
+static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL;
 
         sk_for_each(sk, &rfcomm_sk_list.head) {
-                if (rfcomm_pi(sk)->channel == channel &&
-                                !bacmp(&rfcomm_pi(sk)->src, src))
+                if (rfcomm_pi(sk)->channel != channel)
+                        continue;
+
+                if (bacmp(&rfcomm_pi(sk)->src, src))
+                        continue;
+
+                if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
                         break;
         }
 
@@ -331,6 +336,7 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
 {
         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
         struct sock *sk = sock->sk;
+        int chan = sa->rc_channel;
         int err = 0;
 
         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
@@ -352,12 +358,12 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
 
         write_lock(&rfcomm_sk_list.lock);
 
-        if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
+        if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
                 err = -EADDRINUSE;
         } else {
                 /* Save source address */
                 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
-                rfcomm_pi(sk)->channel = sa->rc_channel;
+                rfcomm_pi(sk)->channel = chan;
                 sk->sk_state = BT_BOUND;
         }
 
@@ -439,7 +445,7 @@ static int rfcomm_sock_listen(struct socket *sock, int backlog)
                 write_lock(&rfcomm_sk_list.lock);
 
                 for (channel = 1; channel < 31; channel++)
-                        if (!__rfcomm_get_sock_by_addr(channel, src)) {
+                        if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
                                 rfcomm_pi(sk)->channel = channel;
                                 err = 0;
                                 break;
@@ -528,6 +534,9 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
+        if (peer && sk->sk_state != BT_CONNECTED)
+                return -ENOTCONN;
+
         memset(sa, 0, sizeof(*sa));
         sa->rc_family  = AF_BLUETOOTH;
         sa->rc_channel = rfcomm_pi(sk)->channel;
@@ -648,6 +657,11 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                if (opt & RFCOMM_LM_FIPS) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 if (opt & RFCOMM_LM_AUTH)
                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
                 if (opt & RFCOMM_LM_ENCRYPT)
@@ -762,7 +776,11 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 case BT_SECURITY_HIGH:
                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
-                                                        RFCOMM_LM_SECURE;
+                              RFCOMM_LM_SECURE;
+                        break;
+                case BT_SECURITY_FIPS:
+                        opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
+                              RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
                         break;
                 default:
                         opt = 0;
@@ -774,6 +792,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
 
                 if (put_user(opt, (u32 __user *) optval))
                         err = -EFAULT;
+
                 break;
 
         case RFCOMM_CONNINFO: