linux-stable.git/net/bluetooth/rfcomm, branch v3.2

Bluetooth: Clear RFCOMM session timer when disconnecting last channel

2011-12-19T00:29:35+00:00

When the last RFCOMM data channel is closed, a timer is normally set
up to disconnect the control channel at a later time.  If the control
channel disconnect command is sent with the timer pending, the timer
needs to be cancelled.

If the timer is not cancelled in this situation, the reference
counting logic for the RFCOMM session does not work correctly when the
remote device closes the L2CAP connection.  The session is freed at
the wrong time, leading to a kernel panic.

Signed-off-by: Mat Martineau 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth

2011-11-02T19:15:51+00:00

Merge branch 'master' of ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2011-10-24T22:18:09+00:00

bluetooth: Properly clone LSM attributes to newly created child connections

2011-10-19T03:36:43+00:00

The Bluetooth stack has internal connection handlers for all of the various
Bluetooth protocols, and unfortunately, they are currently lacking the LSM
hooks found in the core network stack's connection handlers.  I say
unfortunately, because this can cause problems for users who have have an
LSM enabled and are using certain Bluetooth devices.  See one problem
report below:

 * http://bugzilla.redhat.com/show_bug.cgi?id=741703

In order to keep things simple at this point in time, this patch fixes the
problem by cloning the parent socket's LSM attributes to the newly created
child socket.  If we decide we need a more elaborate LSM marking mechanism
for Bluetooth (I somewhat doubt this) we can always revisit this decision
in the future.

Reported-by: James M. Cape 
Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

Bluetooth: rfcomm: Fix sleep in invalid context in rfcomm_security_cfm

2011-10-14T18:04:54+00:00

This was triggered by turning off encryption on ACL link when rfcomm
was using high security. rfcomm_security_cfm (which is called from rx
task) was closing DLC and this involves sending disconnect message
(and locking socket).

Move closing DLC to rfcomm_process_dlcs and only flag DLC for closure
in rfcomm_security_cfm.

BUG: sleeping function called from invalid context at net/core/sock.c:2032
in_atomic(): 1, irqs_disabled(): 0, pid: 1788, name: kworker/0:3
[] (unwind_backtrace+0x0/0x108) from [] (dump_stack+0x20/0x24)
[] (dump_stack+0x20/0x24) from [] (__might_sleep+0x110/0x12c)
[] (__might_sleep+0x110/0x12c) from [] (lock_sock_nested+0x2c/0x64)
[] (lock_sock_nested+0x2c/0x64) from [] (l2cap_sock_sendmsg+0x58/0xcc)
[] (l2cap_sock_sendmsg+0x58/0xcc) from [] (sock_sendmsg+0xb0/0xd0)
[] (sock_sendmsg+0xb0/0xd0) from [] (kernel_sendmsg+0x3c/0x44)
[] (kernel_sendmsg+0x3c/0x44) from [] (rfcomm_send_frame+0x50/0x58)
[] (rfcomm_send_frame+0x50/0x58) from [] (rfcomm_send_disc+0x78/0x80)
[] (rfcomm_send_disc+0x78/0x80) from [] (__rfcomm_dlc_close+0x2d0/0x2fc)
[] (__rfcomm_dlc_close+0x2d0/0x2fc) from [] (rfcomm_security_cfm+0x140/0x1e0)
[] (rfcomm_security_cfm+0x140/0x1e0) from [] (hci_event_packet+0x1ce8/0x4d84)
[] (hci_event_packet+0x1ce8/0x4d84) from [] (hci_rx_task+0x1d0/0x2d0)
[] (hci_rx_task+0x1d0/0x2d0) from [] (tasklet_action+0x138/0x1e4)
[] (tasklet_action+0x138/0x1e4) from [] (__do_softirq+0xcc/0x274)
[] (__do_softirq+0xcc/0x274) from [] (do_softirq+0x60/0x6c)
[] (do_softirq+0x60/0x6c) from [] (local_bh_enable_ip+0xc8/0xd4)
[] (local_bh_enable_ip+0xc8/0xd4) from [] (_raw_spin_unlock_bh+0x48/0x4c)
[] (_raw_spin_unlock_bh+0x48/0x4c) from [] (data_from_chip+0xf4/0xaec)
[] (data_from_chip+0xf4/0xaec) from [] (send_skb_to_core+0x40/0x178)
[] (send_skb_to_core+0x40/0x178) from [] (cg2900_hu_receive+0x15c/0x2d0)
[] (cg2900_hu_receive+0x15c/0x2d0) from [] (hci_uart_tty_receive+0x74/0xa0)
[] (hci_uart_tty_receive+0x74/0xa0) from [] (flush_to_ldisc+0x188/0x198)
[] (flush_to_ldisc+0x188/0x198) from [] (process_one_work+0x144/0x4b8)
[] (process_one_work+0x144/0x4b8) from [] (worker_thread+0x198/0x468)
[] (worker_thread+0x198/0x468) from [] (kthread+0x98/0xa0)
[] (kthread+0x98/0xa0) from [] (kernel_thread_exit+0x0/0x8)

Signed-off-by: Szymon Janc 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Linearize skbs for use in BNEP, CMTP, HIDP, and RFCOMM

2011-09-27T21:15:55+00:00

Fragmented skbs are only encountered when receiving ERTM or streaming
mode L2CAP data.  BNEP, CMTP, HIDP, and RFCOMM generally use basic
mode, but they need to handle fragments without crashing.

Signed-off-by: Mat Martineau 
Signed-off-by: Gustavo F. Padovan

Bluetooth: rfcomm: Fix lost wakeups waiting to accept socket

2011-08-11T22:50:26+00:00

Fix race conditions which can cause lost wakeups (or missed
signals) while waiting to accept an rfcomm socket connection.

Signed-off-by: Peter Hurley 
Signed-off-by: Gustavo F. Padovan

Bluetooth: rfcomm: Remove unnecessary krfcommd event

2011-08-11T22:50:26+00:00

Removed superfluous event handling which was used to signal
that the rfcomm kthread had been woken. This appears to have been
used to prevent lost wakeups. Correctly ordering when the task
state is set to TASK_INTERRUPTIBLE is sufficient to prevent lost wakeups.

To prevent wakeups which occurred prior to initially setting
TASK_INTERRUPTIBLE from being lost, the main work of the thread loop -
rfcomm_process_sessions() - is performed prior to sleeping.

Signed-off-by: Peter Hurley 
Signed-off-by: Gustavo F. Padovan

Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6

2011-06-09T19:33:54+00:00

Conflicts:
	net/bluetooth/rfcomm/sock.c

Bluetooth: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning

2011-06-09T18:30:01+00:00

Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
warning:

In function 'copy_from_user',
    inlined from 'rfcomm_sock_setsockopt' at
    net/bluetooth/rfcomm/sock.c:705:
arch/x86/include/asm/uaccess_64.h:65:
warning: call to 'copy_from_user_overflow' declared with
attribute warning: copy_from_user() buffer size is not provably
correct

presumably due to buf_size being signed causing GCC to fail to
see that buf_size can't become negative.

Cc: Marcel Holtmann 
Cc: Gustavo F. Padovan 
Signed-off-by: Stephen Boyd 
Signed-off-by: Gustavo F. Padovan