2 files changed, 32 insertions, 0 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index b2d279c245cf..82a9e692baed 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1248,10 +1248,18 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
         if (level == SOL_L2CAP)
                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
         lock_sock(sk);
 
         switch (optname) {
         case BT_SECURITY:
+                if (sk->sk_type != SOCK_SEQPACKET) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 sec.level = BT_SECURITY_LOW;
 
                 len = min_t(unsigned int, sizeof(sec), optlen);
@@ -1384,6 +1392,9 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
         if (level == SOL_L2CAP)
                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
         if (get_user(len, optlen))
                 return -EFAULT;
 
@@ -1391,6 +1402,11 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
         switch (optname) {
         case BT_SECURITY:
+                if (sk->sk_type != SOCK_SEQPACKET) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 sec.level = l2cap_pi(sk)->sec_level;
 
                 len = min_t(unsigned int, len, sizeof(sec));
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 9986ef35c890..7f482784e9f7 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -778,10 +778,18 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
         if (level == SOL_RFCOMM)
                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
         lock_sock(sk);
 
         switch (optname) {
         case BT_SECURITY:
+                if (sk->sk_type != SOCK_STREAM) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 sec.level = BT_SECURITY_LOW;
 
                 len = min_t(unsigned int, sizeof(sec), optlen);
@@ -899,6 +907,9 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
         if (level == SOL_RFCOMM)
                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
         if (get_user(len, optlen))
                 return -EFAULT;
 
@@ -906,6 +917,11 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
 
         switch (optname) {
         case BT_SECURITY:
+                if (sk->sk_type != SOCK_STREAM) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 sec.level = rfcomm_pi(sk)->sec_level;
 
                 len = min_t(unsigned int, len, sizeof(sec));