4 files changed, 60 insertions, 17 deletions

diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index be04e9fb11f6..ab166b48ce8d 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -196,6 +196,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
 
         switch (CAPIMSG_SUBCOMMAND(skb->data)) {
         case CAPI_CONF:
+                if (skb->len < CAPI_MSG_BASELEN + 10)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
                 info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
 
@@ -226,6 +229,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_PROFILE:
+                        if (skb->len < CAPI_MSG_BASELEN + 11 + sizeof(capi_profile))
+                                break;
+
                         controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
                         msgnum = CAPIMSG_MSGID(skb->data);
 
@@ -246,17 +252,26 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_MANUFACTURER:
+                        if (skb->len < CAPI_MSG_BASELEN + 15)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_MANUFACTURER_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 14]);
+
+                                memset(ctrl->manu, 0, CAPI_MANUFACTURER_LEN);
                                 strncpy(ctrl->manu,
-                                        skb->data + CAPI_MSG_BASELEN + 15,
-                                        skb->data[CAPI_MSG_BASELEN + 14]);
+                                        skb->data + CAPI_MSG_BASELEN + 15, len);
                         }
 
                         break;
 
                 case CAPI_FUNCTION_GET_VERSION:
+                        if (skb->len < CAPI_MSG_BASELEN + 32)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
@@ -269,13 +284,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_SERIAL_NUMBER:
+                        if (skb->len < CAPI_MSG_BASELEN + 17)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_SERIAL_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 16]);
+
                                 memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
                                 strncpy(ctrl->serial,
-                                        skb->data + CAPI_MSG_BASELEN + 17,
-                                        skb->data[CAPI_MSG_BASELEN + 16]);
+                                        skb->data + CAPI_MSG_BASELEN + 17, len);
                         }
 
                         break;
@@ -284,14 +304,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                 break;
 
         case CAPI_IND:
+                if (skb->len < CAPI_MSG_BASELEN + 6)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
 
                 if (func == CAPI_FUNCTION_LOOPBACK) {
+                        int len = min_t(uint, skb->len - CAPI_MSG_BASELEN - 6,
+                                                skb->data[CAPI_MSG_BASELEN + 5]);
                         appl = CAPIMSG_APPID(skb->data);
                         msgnum = CAPIMSG_MSGID(skb->data);
                         cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
-                                                skb->data + CAPI_MSG_BASELEN + 6,
-                                                skb->data[CAPI_MSG_BASELEN + 5]);
+                                                skb->data + CAPI_MSG_BASELEN + 6, len);
                 }
 
                 break;
@@ -309,6 +333,9 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 
+        if (skb->len < CAPI_MSG_BASELEN)
+                return;
+
         if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
                 cmtp_recv_interopmsg(session, skb);
                 return;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index d4c935692ccf..801d687ea4ef 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -242,7 +242,7 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
         int i;
 
-        if (device_register(&conn->dev) < 0) {
+        if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
@@ -272,6 +272,8 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         dev_set_drvdata(&conn->dev, conn);
 
+        device_initialize(&conn->dev);
+
         INIT_WORK(&conn->work, add_conn);
 
         schedule_work(&conn->work);
@@ -287,6 +289,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
+        if (!device_is_registered(&conn->dev))
+                return;
+
         INIT_WORK(&conn->work, del_conn);
 
         schedule_work(&conn->work);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b7baa7..cb7e855f0828 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int err;
         int sent = 0;
 
         if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
+                int err;
                 
                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                 msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                 if (err) {
                         kfree_skb(skb);
-                        sent = err;
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
                 err = rfcomm_dlc_send(d, skb);
                 if (err < 0) {
                         kfree_skb(skb);
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         release_sock(sk);
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e0e0d09023b2..eb2b52484c70 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        if (!dev || !dev->dlc)
+                return 0;
+
         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
         if (room < 0)
                 room = 0;
+
         return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!skb_queue_empty(&dlc->tx_queue))
-                return dlc->mtu;
+        if (!dev || !dev->dlc)
+                return 0;
+
+        if (!skb_queue_empty(&dev->dlc->tx_queue))
+                return dev->dlc->mtu;
 
         return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev || !dev->dlc)
+                return;
+
         skb_queue_purge(&dev->dlc->tx_queue);
 
         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev)
+                return;
+
         rfcomm_tty_flush_buffer(tty);
 
         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))