Bluetooth: L2CAP: Check bearer type on __l2cap_global_chan_by_addr

The spec defines PSM and LE_PSM as different domains so a listen on the
same PSM is valid if the address type points to a different bearer.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7068eded66c33cd4ea4f0d78334ba15d0a772a7a..007317b072b46738a5c786ee66e09f166197455b 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -168,11 +168,18 @@ static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
        return c;
 }
 
-static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
+static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
+                                                     u8 src_type)
 {
        struct l2cap_chan *c;
 
        list_for_each_entry(c, &chan_list, global_l) {
+               if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
+                       continue;
+
+               if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
+                       continue;
+
                if (c->sport == psm && !bacmp(&c->src, src))
                        return c;
        }
@@ -185,7 +192,7 @@ int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
 
        write_lock(&chan_list_lock);
 
-       if (psm && __l2cap_global_chan_by_addr(psm, src)) {
+       if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
                err = -EADDRINUSE;
                goto done;
        }
@@ -209,7 +216,8 @@ int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
 
                err = -EINVAL;
                for (p = start; p <= end; p += incr)
-                       if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
+                       if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
+                                                        chan->src_type)) {
                                chan->psm   = cpu_to_le16(p);
                                chan->sport = cpu_to_le16(p);
                                err = 0;