patch-2_6_7-vs1_9_1_12

[linux-2.6.git] / net / bluetooth / rfcomm / sock.c

diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1428ce6..1aa1387 100644 (file)
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -398,6 +398,27 @@ int rfcomm_sock_listen(struct socket *sock, int backlog)
                goto done;
        }
 
+       if (!rfcomm_pi(sk)->channel) {
+               bdaddr_t *src = &bt_sk(sk)->src;
+               u8 channel;
+
+               err = -EINVAL;
+
+               write_lock_bh(&rfcomm_sk_list.lock);
+
+               for (channel = 1; channel < 31; channel++)
+                       if (!__rfcomm_get_sock_by_addr(channel, src)) {
+                               rfcomm_pi(sk)->channel = channel;
+                               err = 0;
+                               break;
+                       }
+
+               write_unlock_bh(&rfcomm_sk_list.lock);
+
+               if (err < 0)
+                       goto done;
+       }
+
        sk->sk_max_ack_backlog = backlog;
        sk->sk_ack_backlog = 0;
        sk->sk_state = BT_LISTEN;
@@ -637,7 +658,7 @@ out:
        return copied ? : err;
 }
 
-static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
        struct sock *sk = sock->sk;
        int err = 0;
@@ -656,7 +677,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
        return err;
 }
 
-static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
        struct sock *sk = sock->sk;
        int len, err = 0; 
@@ -686,7 +707,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
        lock_sock(sk);
 
 #ifdef CONFIG_BT_RFCOMM_TTY
-       err = rfcomm_dev_ioctl(sk, cmd, arg);
+       err = rfcomm_dev_ioctl(sk, cmd, (void __user *)arg);
 #else
        err = -EOPNOTSUPP;
 #endif