linux-stable.git/net/bluetooth/l2cap_core.c, branch linux-3.3.y Linux kernel stable tree Bluetooth: Fix possible use after free in delete path 2012-02-15T11:09:26+00:00 Ulisses Furquim ulisses@profusion.mobi 2012-01-30T20:26:29+00:00 24d2b8c0ac5c8ec41c26ed432238b0e027184882 We need to use the _sync() version for cancelling the info and security timer in the L2CAP connection delete path. Otherwise the delayed work handler might run after the connection object is freed. Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> 
We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Remove usage of __cancel_delayed_work() 2012-02-15T11:09:26+00:00 Ulisses Furquim ulisses@profusion.mobi 2012-01-30T20:26:28+00:00 6de32750822d00bfa92c341166132b0714c5b559 __cancel_delayed_work() is being used in some paths where we cannot sleep waiting for the delayed work to finish. However, that function might return while the timer is running and the work will be queued again. Replace the calls with safer cancel_delayed_work() version which spins until the timer handler finishes on other CPUs and cancels the delayed work. Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> 
__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: l2cap_set_timer needs jiffies as timeout value 2012-02-15T11:09:25+00:00 Andrzej Kaczmarek andrzej.kaczmarek@tieto.com 2012-01-04T11:10:42+00:00 6e1da683f79a22fafaada62d547138daaa9e3456 After moving L2CAP timers to workqueues l2cap_set_timer expects timeout value to be specified in jiffies but constants defined in miliseconds are used. This makes timeouts unreliable when CONFIG_HZ is not set to 1000. __set_chan_timer macro still uses jiffies as input to avoid multiple conversions from/to jiffies for sk_sndtimeo value which is already specified in jiffies. Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Ackec-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> 
After moving L2CAP timers to workqueues l2cap_set_timer expects timeout
value to be specified in jiffies but constants defined in miliseconds
are used. This makes timeouts unreliable when CONFIG_HZ is not set to
1000.

__set_chan_timer macro still uses jiffies as input to avoid multiple
conversions from/to jiffies for sk_sndtimeo value which is already
specified in jiffies.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Ackec-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Remove bogus inline declaration from l2cap_chan_connect 2012-02-15T11:09:25+00:00 Johan Hedberg johan.hedberg@intel.com 2012-01-08T20:51:16+00:00 4aa832c27edf902130f8bace1d42cf22468823fa As reported by Dan Carpenter this function causes a Sparse warning and shouldn't be declared inline: include/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a definition" Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> 
As reported by Dan Carpenter this function causes a Sparse warning and
shouldn't be declared inline:

include/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a
definition"

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next 2012-01-10T20:44:17+00:00 John W. Linville linville@tuxdriver.com 2012-01-10T20:44:17+00:00 874c60bad92564358e87d58f505fceb0b09ec1aa 






Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
2012-01-03T20:16:34+00:00

John W. Linville
linville@tuxdriver.com

2012-01-03T20:16:34+00:00

57adc1fcbae2c13104ce291b40f23e40a414fa87

Conflicts:
	drivers/net/wireless/b43/dma.c
	drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c





Conflicts:
	drivers/net/wireless/b43/dma.c
	drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c







Bluetooth: Don't use *_bh locks anymore
2012-01-03T03:38:36+00:00

Gustavo F. Padovan
padovan@profusion.mobi

2011-12-22T17:14:39+00:00

333055f2aaabadb951b5ecd90f6a20a9aee38c29

Those locks are not shared between interrupt and process context anymore,
so remove the part that disable interrupts.  We are still safe because
preemption is disabled.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>





Those locks are not shared between interrupt and process context anymore,
so remove the part that disable interrupts.  We are still safe because
preemption is disabled.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>







Bluetooth: Fix bacpy in l2cap_core.c
2012-01-02T22:08:04+00:00

Gustavo F. Padovan
padovan@profusion.mobi

2012-01-02T22:08:04+00:00

9219b2a08c8a1ca9935b85ec4ab119bb55b0cb15

It should be the dst in the copy not src. 03a001948 introduced this bug.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>





It should be the dst in the copy not src. 03a001948 introduced this bug.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>







Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2011-12-23T22:13:56+00:00

David S. Miller
davem@davemloft.net

2011-12-23T22:13:56+00:00

abb434cb0539fb355c1c921f8fd761efbbac3462

Conflicts:
	net/bluetooth/l2cap_core.c

Just two overlapping changes, one added an initialization of
a local variable, and another change added a new local variable.

Signed-off-by: David S. Miller <davem@davemloft.net>





Conflicts:
	net/bluetooth/l2cap_core.c

Just two overlapping changes, one added an initialization of
a local variable, and another change added a new local variable.

Signed-off-by: David S. Miller <davem@davemloft.net>







Bluetooth: add debug output to l2cap_ack_timeout()
2011-12-22T20:00:54+00:00

Gustavo F. Padovan
padovan@profusion.mobi

2011-12-22T18:56:05+00:00

2fb9b3d4e5d720d4033461519af0d3f789924015

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>





Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>