Bluetooth: hci_intel: Show error in case of invalid LPM packet size

Don't hide this packet size error.

Signed-off-by: Loic Poulain <loic.poulain@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 9fd1143bc78f80abf7723b6970fbf338f7f3eb15..b4dc3c5b384128fb6d79f5d3b664bde95a0c162a 100644 (file)
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -1010,8 +1010,11 @@ static int intel_recv_lpm(struct hci_dev *hdev, struct sk_buff *skb)
 
        switch (lpm->opcode) {
        case LPM_OP_TX_NOTIFY:
-               if (lpm->dlen)
-                       intel_recv_lpm_notify(hdev, lpm->data[0]);
+               if (lpm->dlen < 1) {
+                       bt_dev_err(hu->hdev, "Invalid LPM notification packet");
+                       break;
+               }
+               intel_recv_lpm_notify(hdev, lpm->data[0]);
                break;
        case LPM_OP_SUSPEND_ACK:
                set_bit(STATE_SUSPENDED, &intel->flags);