From 15c7886fad5a5ee1e231eddb6310e9ae2dfcad06 Mon Sep 17 00:00:00 2001
From: Gregory Nutt <gnutt@nuttx.org>
Date: Mon, 2 Apr 2018 13:03:46 -0600
Subject: [PATCH] include/nuttx/wireless:  All Bluetooth IOCTL command data
 must begin with the interface name string.

---
 include/nuttx/wireless/bt_ioctl.h | 24 ++++++++++++++++++++----
 wireless/bluetooth/bt_ioctl.c     | 18 +++++++++++++-----
 2 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/include/nuttx/wireless/bt_ioctl.h b/include/nuttx/wireless/bt_ioctl.h
index 326f510a1d..6326ea822f 100644
--- a/include/nuttx/wireless/bt_ioctl.h
+++ b/include/nuttx/wireless/bt_ioctl.h
@@ -125,7 +125,7 @@
 /* SIOCBT_SCANSTART
  *   Description:   Start LE scanning.  Buffered scan results may be
  *                  obtained via SIOCBT_SCANGET
- *   Input:         1=Duplicate filtering enabled
+ *   Input:         A read-only referent to struct bt_scanstart_s.
  *   Output:        None
  */
 
@@ -144,7 +144,8 @@
 
 /* SIOCBT_SCANSTOP
  *   Description:   Stop LE scanning and discard any buffered results.
- *   Input:         None
+ *   Input:         A reference to a write-able instance of struct
+ *                  bt_scanstop_s.
  *   Output:        None
  */
 
@@ -244,6 +245,21 @@ struct bt_advertisestart_s
   FAR const struct bt_eir_s as_sd; /* Data for scan response packets */
 };
 
+/* The read-only data that accompanies the SIOCBT_SCANSTART IOCTL command */
+
+struct bt_scanstart_s
+{
+  char ss_name[HCI_DEVNAME_SIZE];   /* Device name */
+  bool ss_dupenable;                /* True: enable duplicate filtering */
+};
+
+/* The read-only data that accompanies the SIOCBT_SCANSTOP IOCTL command */
+
+struct bt_scanstop_s
+{
+  char st_name[HCI_DEVNAME_SIZE];   /* Device name */
+};
+
 /* Write-able data that accompanies the SIOCBT_SCANGET IOCTL command */
 
 struct bt_scanresponse_s
@@ -259,9 +275,9 @@ struct bt_scanresponse_s
 struct bt_scanresult_s
 {
   char sr_name[HCI_DEVNAME_SIZE];   /* Device name */
-  uint8_t sc_nrsp;                  /* Input:  Max number of responses
+  uint8_t sr_nrsp;                  /* Input:  Max number of responses
                                      * Return: Actual number of responses */
-  struct bt_scanresponse_s sc_rsp[1];
+  struct bt_scanresponse_s sr_rsp[1];
 };
 
 #define SIZEOF_BT_SCANRESULT_S(n) \
diff --git a/wireless/bluetooth/bt_ioctl.c b/wireless/bluetooth/bt_ioctl.c
index bc4a48a85c..28aa2a86bd 100644
--- a/wireless/bluetooth/bt_ioctl.c
+++ b/wireless/bluetooth/bt_ioctl.c
@@ -315,17 +315,23 @@ int btnet_ioctl(FAR struct net_driver_s *dev, int cmd, unsigned long arg)
       /* SIOCBT_SCANSTART
        *   Description:   Start LE scanning.  Buffered scan results may be
        *                  obtained via SIOCBT_SCANGET
-       *   Input:         1=Duplicate filtering enabled
+       *   Input:         A read-only referent to struct bt_scanstart_s.
        *   Output:        None
        */
 
       case SIOCBT_SCANSTART:
         {
-          uint8_t dup_enable = (arg == 0) ? 0 : BT_LE_SCAN_FILTER_DUP_ENABLE;
+          FAR struct bt_scanstart_s *start =
+            (FAR struct bt_scanstart_s *)((uintptr_t)arg);
+
+          if (start == NULL)
+            {
+              ret = -EINVAL;
+            }
 
           /* Are we already scanning? */
 
-          if (g_scanstate.bs_scanning)
+          else if (g_scanstate.bs_scanning)
             {
               ret = -EBUSY;
             }
@@ -338,7 +344,8 @@ int btnet_ioctl(FAR struct net_driver_s *dev, int cmd, unsigned long arg)
               g_scanstate.bs_head     = 0;
               g_scanstate.bs_tail     = 0;
 
-              ret = bt_start_scanning(dup_enable, btnet_scan_callback);
+              ret = bt_start_scanning(start->ss_dupenable,
+                                      btnet_scan_callback);
               wlinfo("Start scan: %d\n", ret);
 
               if (ret < 0)
@@ -378,7 +385,8 @@ int btnet_ioctl(FAR struct net_driver_s *dev, int cmd, unsigned long arg)
 
       /* SIOCBT_SCANSTOP
        *   Description:   Stop LE scanning and discard any buffered results.
-       *   Input:         None
+       *   Input:         A reference to a write-able instance of struct
+       *                  bt_scanstop_s.
        *   Output:        None
        */