summaryrefslogtreecommitdiff
path: root/net/bluetooth/l2cap_sock.c
AgeCommit message (Collapse)AuthorFilesLines
2013-10-21Bluetooth: Do not access chan->sk directlyGustavo Padovan1-1/+2
In the process of removing socket usage from L2CAP we now access the L2CAP socket from the data member of struct l2cap_chan. For the L2CAP socket user the data member points to the L2CAP socket. Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-18Bluetooth: Fix ATT socket backwards compatibility with user spaceJohan Hedberg1-2/+25
Old user space versions bind the Attribute Protocol socket to BDADDR_BREDR when they should be using BDADDR_LE_PUBLIC or BDADDR_LE_RANDOM. The kernel recently introduced stricter checks on the socket parameters but we need to punch this hole for old user space versions to keep them working. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-16Bluetooth: Socket address parameter for CID is in little endianMarcel Holtmann1-2/+2
The L2CAP socket parameter for CID are actually provided in little endian. So convert our constants into little endian before comparing them. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-16Bluetooth: Reintroduce socket restrictions for LE socketsJohan Hedberg1-0/+18
Right now we do not allow user space to use connection oriented channels on LE, and the only CID that can be used is the Attribute Protocol one. These restrictions went away together with the recent refactoring of the L2CAP code, but this patch puts them back to their appropriate places. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-15Bluetooth: Move l2cap_wait_ack() to l2cap_sock.cGustavo Padovan1-0/+32
The wait_ack code has a heavy dependency on the socket data structures and, as of now, it won't be worthless change it to use non-socket structures as the only user of such feature is a socket. Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-15Bluetooth: Add chan->ops->set_shutdown()Gustavo Padovan1-0/+10
We need to remove all direct access of struct sock from L2CAP core. This change is pretty simple and just add a new L2CAP channel callback to do the work in the L2CAP socket side. Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-15Bluetooth: Access sk_sndtimeo indirectly in l2cap_core.cGustavo Padovan1-0/+8
As part of the work to remove struct sock from l2cap_core.c and make it more generic we remove in this commit the direct access to sk->sk_sndtimeo member. This objective of this change is purely remove sk usage from l2cap_core.c Now we have a new l2cap ops to get the current value of sk->sndtimeo. A l2cap_chan_no_get_sndtimeo was added for users of L2CAP that doesn't need to set a timeout. Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-15Bluetooth: Extend state_change() call to report errors tooGustavo Padovan1-1/+5
Instead of creating an new function pointer to report errors we are just reusing state_change for that and there is a simple reason for this, one place in the l2cap_core.c code needs, in a locked sk, set both the sk_state and sk_err. If we create two different functions for this we would need to release the lock between the two operation putting the socket in non desired state. The change is transparent to the l2cap_core.c code, user that only needs to set the state won't need any modification. This is another step of an ongoing work to make l2cap_core.c totally independent from l2cap's struct sock. Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-14Bluetooth: Check that bind() bdaddr type matches connect()Johan Hedberg1-0/+6
If a socket was bound to an address type other than BR/EDR (such as LE) we should reject trying to connect it to a BR/EDR address. The same applies for binding to BR/EDR and trying to connect to non-BR/EDR. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-14Bluetooth: Reject invalid bdaddr types for socketsJohan Hedberg1-0/+6
We need to verify that the bdaddr type passed to connect() and bind() is within the set of valid values. If it is not we need to cleanly fail with EINVAL. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-14Bluetooth: Introduce L2CAP channel callback for resumingMarcel Holtmann1-0/+9
Clearing the BT_SK_SUSPEND socket flag from the L2CAP core is causing a dependency on the socket. So intead of doing that, use a channel callback into the socket handling to resume. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-14Bluetooth: Introduce L2CAP channel flag for defer setupMarcel Holtmann1-2/+5
The L2CAP core should not look into the socket flags to figure out the setting of defer setup. So introduce a L2CAP channel flag that mirrors the socket flag. Since the defer setup option is only set in one place this becomes a really easy thing to do. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-13Bluetooth: Provide msg_name callback for L2CAP connectionless channelsMarcel Holtmann1-1/+14
The L2CAP connectionless channels use SOCK_DGRAM and recvmsg() and need to receive the remote BD_ADDR and PSM information via msg_name from the recvmsg() system call. So in case the L2CAP socket is for connectionless channels, provide a msg_name callback that can update the data. Also store the remote BD_ADDR and PSM in the skb so it can be extracted later on. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-13Bluetooth: Use l2cap_pi(sk) directly where possibleMarcel Holtmann1-8/+7
There are few places where it makes sense to use l2cap_pi(sk) directly instead of assigning it to temporary structure. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-13Bluetooth: Return the correct address type for L2CAP socketsMarcel Holtmann1-0/+3
The L2CAP sockets can use BR/EDR public, LE public and LE random addresses for various combinations of source and destination devices. So make sure that getsockname(), getpeername() and accept() return the correct address type. For this the address type of the source and destination is stored with the L2CAP channel information. The stored address type is not the one specific for the HCI protocol. It is the address type used for the L2CAP sockets and the management interface. The underlying HCI connections store the HCI address type. If needed, it gets converted to the socket address type. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-13Bluetooth: Store address information in L2CAP channel structureMarcel Holtmann1-3/+3
With the effort of abstracting the L2CAP socket from the underlying L2CAP channel it is important to store the source and destination address information directly in the L2CAP channel structure. Direct access to the HCI connection address information is not possible since they might not be avaiable at L2CAP channel creation time. The address information will be updated when the underlying BR/EDR or LE connection status changes. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-12Bluetooth: Allow 3D profile to use security mode 4 level 0Marcel Holtmann1-0/+4
The PSM 0x0021 is dedicated to the 3D profile and has permission to use security mode 4 level 0 for L2CAP connectionless unicast data transfers. When establishing a L2CAP connectionless channel on PSM 0x0021, it will no longer force Secure Simple Pairing. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-12Bluetooth: Limit security mode 4 level 0 to connection oriented channelsMarcel Holtmann1-3/+7
The exception for certain PSM channels when it comes to security mode 4 level 0 should only be checked when actually a connection oriented channel is established. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-11Bluetooth: Move smp.h header file into net/bluetooth/Marcel Holtmann1-1/+2
The smp.h header file is only used internally by the bluetooth.ko module and is not a public API. So make it local to the core Bluetooth module. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-10-07Bluetooth: Fix variable shadow warningsJohannes Berg1-1/+1
Sparse points out three places where variables are shadowed, rename two of the variables and remove the duplicate third. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2013-10-02Bluetooth: Provide high speed configuration optionMarcel Holtmann1-10/+0
Hiding the Bluetooth high speed support behind a module parameter is not really useful. This can be enabled and disabled at runtime via the management interface. This also has the advantage that this can now be changed per controller and not just global. This patch removes the module parameter and exposes the high speed setting of the management interface to all controllers. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2013-09-25Bluetooth: Clean up socket locking in l2cap_sock_recvmsgJohan Hedberg1-2/+2
This patch cleans up the locking login in l2cap_sock_recvmsg by pairing up each lock_sock call with a release_sock call. The function already has a "done" label that handles releasing the socket and returning from the function so the fix is rather simple. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-09-18Bluetooth: Fix waiting for clearing of BT_SK_SUSPEND flagJohan Hedberg1-0/+6
In the case of blocking sockets we should not proceed with sendmsg() if the socket has the BT_SK_SUSPEND flag set. So far the code was only ensuring that POLLOUT doesn't get set for non-blocking sockets using poll() but there was no code in place to ensure that blocking sockets do the right thing when writing to them. This patch adds a new bt_sock_wait_ready helper function to sleep in the sendmsg call if the BT_SK_SUSPEND flag is set, and wake up as soon as it is unset. It also updates the L2CAP and RFCOMM sendmsg callbacks to take advantage of this new helper function. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-06-23Bluetooth: Rename L2CAP_CID_LE_DATA to L2CAP_CID_ATTJohan Hedberg1-2/+2
In future Core Specification versions the ATT CID will be just one of many possible CIDs that can be used for data transfer. Therefore, it makes sense to rename the define for the ATT CID to something less ambigous. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-05-01Merge branch 'for-linus' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull VFS updates from Al Viro, Misc cleanups all over the place, mainly wrt /proc interfaces (switch create_proc_entry to proc_create(), get rid of the deprecated create_proc_read_entry() in favor of using proc_create_data() and seq_file etc). 7kloc removed. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits) don't bother with deferred freeing of fdtables proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h proc: Make the PROC_I() and PDE() macros internal to procfs proc: Supply a function to remove a proc entry by PDE take cgroup_open() and cpuset_open() to fs/proc/base.c ppc: Clean up scanlog ppc: Clean up rtas_flash driver somewhat hostap: proc: Use remove_proc_subtree() drm: proc: Use remove_proc_subtree() drm: proc: Use minor->index to label things, not PDE->name drm: Constify drm_proc_list[] zoran: Don't print proc_dir_entry data in debug reiserfs: Don't access the proc_dir_entry in r_open(), r_start() r_show() proc: Supply an accessor for getting the data from a PDE's parent airo: Use remove_proc_subtree() rtl8192u: Don't need to save device proc dir PDE rtl8187se: Use a dir under /proc/net/r8180/ proc: Add proc_mkdir_data() proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h} proc: Move PDE_NET() to fs/proc/proc_net.c ...
2013-04-09bluetooth: kill unused 'module' argument of bt_procfs_init()Al Viro1-1/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-04-05Bluetooth: hidp: verify l2cap socketsDavid Herrmann1-0/+6
We need to verify that the given sockets actually are l2cap sockets. If they aren't, we are not supposed to access bt_sk(sock) and we shouldn't start the session if the offsets turn out to be valid local BT addresses. That is, if someone passes a TCP socket to HIDCONNADD, then we access some random offset in the TCP socket (which isn't even guaranteed to be valid). Fix this by checking that the socket is an l2cap socket. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-03-08Bluetooth: discard bt_sock_unregister() errorsDavid Herrmann1-3/+1
After we successfully registered a socket via bt_sock_register() there is no reason to ever check the return code of bt_sock_unregister(). If bt_sock_unregister() fails, it means the socket _is_ already unregistered so we have what we want, don't we? Also, to get bt_sock_unregister() to fail, another part of the kernel has to unregister _our_ socket. This is sooo _wrong_ that it will break way earlier than when we unregister our socket. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-24Bluetooth: Start channel move when socket option is changedMat Martineau1-0/+5
Channel moves are triggered by changes to the BT_CHANNEL_POLICY sockopt when an ERTM or streaming-mode channel is connected. Moves are only started if enable_hs is true. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-19Merge branch 'master' of ↵John W. Linville1-31/+58
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
2012-10-15Bluetooth: Add chan->ops->defer()Gustavo Padovan1-0/+10
When DEFER_SETUP is set defer() will trigger an authorization request to the userspace. l2cap_chan_no_defer() is meant to be used when one does not want to support DEFER_SETUP (A2MP for example). Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-15Bluetooth: Move bt_accept_enqueue() to l2cap_sock.cGustavo Padovan1-0/+2
This is part of the move the parent socket usage to l2cap_sock.c The change is safe when it comes to locking, bt_accept_enqueue() is still protected by the parent socket lock inside the l2cap_sock_new_connection_cb() code. Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-12Bluetooth: Fix L2CAP coding styleGustavo Padovan1-25/+37
Follow the net subsystem coding style Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-11Bluetooth: Allow to set flush timeoutAndrei Emeltchenko1-0/+1
Enable setting of flush timeout via setsockopt Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-09Bluetooth: don't attempt to free a channel that wasn't createdSasha Levin1-1/+2
We may currently attempt to free a channel which wasn't created due to an error in the initialization path, this would cause a NULL ptr deref. This would cause the following oops: [ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 12.919131] IP: [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919135] PGD 0 [ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 12.919193] Dumping ftrace buffer: [ 12.919242] (ftrace buffer empty) [ 12.919314] Modules linked in: [ 12.919318] CPU 1 [ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30 [ 12.919374] RIP: 0010:[<ffffffff836645c4>] [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246 [ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667 [ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010 [ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001 [ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000 [ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001 [ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000 [ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0 [ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000) [ 12.919506] Stack: [ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc [ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae [ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200 [ 12.919517] Call Trace: [ 12.919522] [<ffffffff8366c7bc>] l2cap_sock_destruct+0x3c/0x80 [ 12.919527] [<ffffffff833ae0ae>] __sk_free+0x1e/0x1f0 [ 12.919530] [<ffffffff833ae2f7>] sk_free+0x17/0x20 [ 12.919585] [<ffffffff8366ca4e>] l2cap_sock_alloc.constprop.5+0x9e/0xd0 [ 12.919591] [<ffffffff8366cb9e>] l2cap_sock_create+0x7e/0x100 [ 12.919652] [<ffffffff83a4f32a>] ? _raw_read_lock+0x6a/0x80 [ 12.919658] [<ffffffff836402c4>] ? bt_sock_create+0x74/0x110 [ 12.919660] [<ffffffff83640308>] bt_sock_create+0xb8/0x110 [ 12.919664] [<ffffffff833aa232>] __sock_create+0x282/0x3b0 [ 12.919720] [<ffffffff833aa0b0>] ? __sock_create+0x100/0x3b0 [ 12.919725] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919779] [<ffffffff833aa37f>] sock_create_kern+0x1f/0x30 [ 12.919784] [<ffffffff83675714>] rfcomm_l2sock_create+0x44/0x70 [ 12.919787] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919790] [<ffffffff836785fe>] rfcomm_run+0x4e/0x1f0 [ 12.919846] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919852] [<ffffffff81138ee3>] kthread+0xe3/0xf0 [ 12.919908] [<ffffffff8117b12e>] ? put_lock_stats.isra.14+0xe/0x40 [ 12.919914] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.919968] [<ffffffff83a5077c>] ret_from_fork+0x7c/0x90 [ 12.919973] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80 ac 3a fe 48 8d 7b 10 <f0> 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08 [ 12.920165] RIP [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.920166] RSP <ffff880066933c38> [ 12.920167] CR2: 0000000000000010 [ 12.920417] ---[ end trace 5a9114e8a158ab84 ]--- Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan reference counting"). Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-10-08Bluetooth: Fix dereference after NULL checkAndrei Emeltchenko1-5/+6
Move code dereferencing possible NULL pointer to the check branch. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-09-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller1-1/+1
Conflicts: net/netfilter/nfnetlink_log.c net/netfilter/xt_LOG.c Rather easy conflict resolution, the 'net' tree had bug fixes to make sure we checked if a socket is a time-wait one or not and elide the logging code if so. Whereas on the 'net-next' side we are calculating the UID and GID from the creds using different interfaces due to the user namespace changes from Eric Biederman. Signed-off-by: David S. Miller <davem@davemloft.net>
2012-09-07Merge branch 'master' of ↵John W. Linville1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
2012-09-07Merge branch 'master' of ↵John W. Linville1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem John W. Linville says: ==================== Please pull these fixes intended for 3.6. There are more commits here than I would like -- I got a bit behind while I was stalking Steven Rostedt in San Diego last week... I'll slow it down after this! There are a couple of pulls here. One is from Johannes: "Please pull (according to the below information) to get a few fixes. * a fix to properly disconnect in the driver when authentication or association fails * a fix to prevent invalid information about mesh paths being reported to userspace * a memory leak fix in an nl80211 error path" The other comes via Gustavo: "A few updates for the 3.6 kernel. There are two btusb patches to add more supported devices through the new USB_VENDOR_AND_INTEFACE_INFO() macro and another one that add a new device id for a Sony Vaio laptop, one fix for a user-after-free and, finally, two patches from Vinicius to fix a issue in SMP pairing." Along with those... Arend van Spriel provides a fix for a use-after-free bug in brcmfmac. Daniel Drake avoids a hang by not trying to touch the libertas hardware duing suspend if it is already powered-down. Felix Fietkau provides a batch of ath9k fixes that adress some potential problems with power settings, as well as a fix to avoid a potential interrupt storm. Gertjan van Wingerde provides a register-width fix for rt2x00, and a rt2x00 fix to prevent incorrectly detecting the rfkill status. He also provides a device ID patch. Hante Meuleman gives us three brcmfmac fixes, one that properly initializes a command structure, one that fixes a race condition that could lose usb requests, and one that removes some log spam. Marc Kleine-Budde offers an rt2x00 fix for a voltage setting on some specific devices. Mohammed Shafi Shajakhan sent an ath9k fix to avoid a crash related to using timers that aren't allocated when 2 wire bluetooth coexistence hardware is in use. Sergei Poselenov changes rt2800usb to do some validity checking for received packets, avoiding crashes on an ARM Soc. Stone Piao gives us an mwifiex fix for an incorrectly set skb length value for a command buffer. All of these are localized to their specific drivers, and relatively small. The power-related patches from Felix are bigger than I would like, but I merged them in consideration of their isolation to ath9k and the sensitive nature of power settings in wireless devices. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-27Bluetooth: Change signature of smp_conn_security()Vinicius Costa Gomes1-1/+1
To make it clear that it may be called from contexts that may not have any knowledge of L2CAP, we change the connection parameter, to receive a hci_conn. This also makes it clear that it is checking the security of the link. Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-08-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller1-1/+2
2012-08-15Bluetooth: L2CAP - Fix info leak via getsockname()Mathias Krause1-0/+1
The L2CAP code fails to initialize the l2_bdaddr_type member of struct sockaddr_l2 and the padding byte added for alignment. It that for leaks two bytes kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-06Bluetooth: Fix socket not getting freed if l2cap channel create failsJaganath Kanakkassery1-1/+1
If l2cap_chan_create() fails then it will return from l2cap_sock_kill since zapped flag of sk is reset. Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-08-06Bluetooth: Added /proc/net/l2cap via bt_procfs_init()Masatake YAMATO1-2/+18
Added /proc/net/l2cap via bt_procfs_init(). Signed-off-by: Masatake YAMATO <yamato@redhat.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-08-06Bluetooth: Free the l2cap channel list only when refcount is zeroJaganath Kanakkassery1-1/+1
Move the l2cap channel list chan->global_l under the refcnt protection and free it based on the refcnt. Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com> Signed-off-by: Syam Sidhardhan <s.syam@samsung.com> Reviewed-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-06-05Bluetooth: Rename L2CAP_LE_DEFAULT_MTUAndre Guedes1-1/+1
This patch renames L2CAP_LE_DEFAULT_MTU macro to L2CAP_LE_MIN_MTU since it represents the minimum MTU value, not the default MTU value for LE. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-06-05Bluetooth: Check MTU value in l2cap_sock_setsockopt_oldAndre Guedes1-0/+21
If user tries to set an invalid MTU value, l2cap_sock_setsockopt_old should return -EINVAL. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-06-05Bluetooth: Move check for backlog size to l2cap_sock.cGustavo Padovan1-0/+6
Remove socket specific code from l2cap_core.c Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2012-06-05Bluetooth: Add l2cap_chan->ops->ready()Andrei Emeltchenko1-0/+21
This move socket specific code to l2cap_sock.c. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2012-06-05Bluetooth: Move clean up code and set of SOCK_ZAPPED to l2cap_sock.cAndrei Emeltchenko1-0/+61
This remove a bit more of socket code from l2cap core, this calls set the SOCK_ZAPPED and do some clean up depending on the socket state. Reported-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-16 14:14:06 +0000