linux-stable.git/include/net/bluetooth/bluetooth.h, branch linux-5.4.y

Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks

2022-07-29T15:14:19+00:00

commit 29fb608396d6a62c1b85acc421ad7a4399085b9f upstream.

Since bt_skb_sendmmsg can be used with the likes of SOCK_STREAM it
shall return the partial chunks it could allocate instead of freeing
everything as otherwise it can cause problems like bellow.

Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg")
Reported-by: Paul Menzel 
Link: https://lore.kernel.org/r/d7206e12-1b99-c3be-84f4-df22af427ef5@molgen.mpg.de
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215594
Signed-off-by: Luiz Augusto von Dentz 
Tested-by: Paul Menzel  (Nokia N9 (MeeGo/Harmattan)
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix passing NULL to PTR_ERR

2022-07-29T15:14:19+00:00

commit 266191aa8d14b84958aaeb5e96ee4e97839e3d87 upstream.

Passing NULL to PTR_ERR will result in 0 (success), also since the likes of
bt_skb_sendmsg does never return NULL it is safe to replace the instances of
IS_ERR_OR_NULL with IS_ERR when checking its return.

Reported-by: Dan Carpenter 
Tested-by: Tedd Ho-Jeong An 
Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmmsg helper

2022-07-29T15:14:18+00:00

commit 97e4e80299844bb5f6ce5a7540742ffbffae3d97 upstream.

This works similarly to bt_skb_sendmsg but can split the msg into
multiple skb fragments which is useful for stream sockets.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmsg helper

2022-07-29T15:14:18+00:00

commit 38f64f650dc0e44c146ff88d15a7339efa325918 upstream.

bt_skb_sendmsg helps takes care of allocation the skb and copying the
the contents of msg over to the skb while checking for possible errors
so it should be safe to call it without holding lock_sock.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix locking in bt_accept_enqueue() for BH context

2019-01-22T08:51:20+00:00

With commit e16337622016 ("Bluetooth: Handle bt_accept_enqueue() socket
atomically") lock_sock[_nested]() is used to acquire the socket lock
before manipulating the socket. lock_sock[_nested]() may block, which
is problematic since bt_accept_enqueue() can be called in bottom half
context (e.g. from rfcomm_connect_ind()):

[] __might_sleep+0x4c/0x80
[] lock_sock_nested+0x24/0x58
[] bt_accept_enqueue+0x48/0xd4 [bluetooth]
[] rfcomm_connect_ind+0x190/0x218 [rfcomm]

Add a parameter to bt_accept_enqueue() to indicate whether the
function is called from BH context, and acquire the socket lock
with bh_lock_sock_nested() if that's the case.

Also adapt all callers of bt_accept_enqueue() to pass the new
parameter:

- l2cap_sock_new_connection_cb()
  - uses lock_sock() to lock the parent socket => process context

- rfcomm_connect_ind()
  - acquires the parent socket lock with bh_lock_sock() => BH
    context

- __sco_chan_add()
  - called from sco_chan_add(), which is called from sco_connect().
    parent is NULL, hence bt_accept_enqueue() isn't called in this
    code path and we can ignore it
  - also called from sco_conn_ready(). uses bh_lock_sock() to acquire
    the parent lock => BH context

Fixes: e16337622016 ("Bluetooth: Handle bt_accept_enqueue() socket atomically")
Signed-off-by: Matthias Kaehlcke 
Reviewed-by: Douglas Anderson 
Signed-off-by: Marcel Holtmann 
Cc: stable@vger.kernel.org

Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL

2018-06-28T17:40:47+00:00

The poll() changes were not well thought out, and completely
unexplained.  They also caused a huge performance regression, because
"->poll()" was no longer a trivial file operation that just called down
to the underlying file operations, but instead did at least two indirect
calls.

Indirect calls are sadly slow now with the Spectre mitigation, but the
performance problem could at least be largely mitigated by changing the
"->get_poll_head()" operation to just have a per-file-descriptor pointer
to the poll head instead.  That gets rid of one of the new indirections.

But that doesn't fix the new complexity that is completely unwarranted
for the regular case.  The (undocumented) reason for the poll() changes
was some alleged AIO poll race fixing, but we don't make the common case
slower and more complex for some uncommon special case, so this all
really needs way more explanations and most likely a fundamental
redesign.

[ This revert is a revert of about 30 different commits, not reverted
  individually because that would just be unnecessarily messy  - Linus ]

Cc: Al Viro 
Cc: Christoph Hellwig 
Signed-off-by: Linus Torvalds

net/bluetooth: convert to ->poll_mask

2018-05-26T07:16:44+00:00

Signed-off-by: Christoph Hellwig

net: annotate ->poll() instances

2017-11-27T21:20:04+00:00

Signed-off-by: Al Viro

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2017-10-30T10:25:45+00:00

In case of using BT_ERR and BT_INFO, convert to bt_dev_err and
bt_dev_info when possible. This allows for controller specific
reporting.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: make baswap src const

2017-09-01T20:49:47+00:00

Signed-off-by: Loic Poulain 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Marcel Holtmann