7 files changed, 16 insertions, 12 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index f6a1671ea2ff..56ca494621c6 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -224,10 +224,9 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
-                if (sk->sk_shutdown & RCV_SHUTDOWN) {
-                        msg->msg_namelen = 0;
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
                         return 0;
-                }
+
                 return err;
         }
 
@@ -245,8 +244,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (bt_sk(sk)->skb_msg_name)
                         bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
                                                 &msg->msg_namelen);
-                else
-                        msg->msg_namelen = 0;
         }
 
         skb_free_datagram(sk, skb);
@@ -295,8 +292,6 @@ int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        msg->msg_namelen = 0;
-
         BT_DBG("sk %p size %zu", sk, size);
 
         lock_sock(sk);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 71f0be173080..6a6c8bb4fd72 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -856,8 +856,6 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         int err;
         struct sk_buff_head seg_queue;
 
+        if (!chan->conn)
+                return -ENOTCONN;
+
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c4d3d423f89b..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -615,7 +615,6 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
-                msg->msg_namelen = 0;
                 return 0;
         }
 
@@ -739,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
         struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -783,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
+
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 12a0e51e21e1..24fa3964b3c8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -711,7 +711,6 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                 sk->sk_state = BT_CONFIG;
-                msg->msg_namelen = 0;
 
                 release_sock(sk);
                 return 0;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
+
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
         if (smp_ltk_encrypt(conn, hcon->pending_sec_level))