u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data)); 
u16 opcode = __le16_to_cpu(get_unaligned((__le16 *) skb->data)); 
static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 			    struct msghdr *msg, size_t len){	struct sock *sk = sock->sk;	struct hci_dev *hdev;	struct sk_buff *skb;	int err;	BT_DBG("sock %p sk %p", sock, sk);	if (msg->msg_flags & MSG_OOB)		return -EOPNOTSUPP;	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))		return -EINVAL;	if (len < 4 || len > HCI_MAX_FRAME_SIZE)		return -EINVAL;	lock_sock(sk);	if (!(hdev = hci_pi(sk)->hdev)) {		err = -EBADFD;		goto done;	}	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))		goto done;	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {		err = -EFAULT;		goto drop;	}	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);	skb_pull(skb, 1);	skb->dev = (void *) hdev;	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {		u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));		u16 ogf = hci_opcode_ogf(opcode);		u16 ocf = hci_opcode_ocf(opcode);		if (((ogf > HCI_SFLT_MAX_OGF) ||				!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&					!capable(CAP_NET_RAW)) {			err = -EPERM;			goto drop;		}		if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {			skb_queue_tail(&hdev->raw_q, skb);			hci_sched_tx(hdev);		} else {			skb_queue_tail(&hdev->cmd_q, skb);			hci_sched_cmd(hdev);		}	} else {		if (!capable(CAP_NET_RAW)) {			err = -EPERM;			goto drop;		}		skb_queue_tail(&hdev->raw_q, skb);		hci_sched_tx(hdev);	}	err = len;done:	release_sock(sk);	return err;drop:	kfree_skb(skb);	goto done;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/1ebb92521d0bc2d4ef772730d29333c06b807191/hci_sock.c/buggy/net/bluetooth/hci_sock.c