linux-stable.git/net/bluetooth, branch linux-3.6.y

Bluetooth: Fix having bogus entries in mgmt_read_index_list reply

2012-11-26T20:14:18+00:00

commit 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 upstream.

The mgmt_read_index_list uses one loop to calculate the max needed size
of its response with the help of an upper-bound of the controller count.
The second loop is more strict as it checks for HCI_SETUP (which might
have gotten set after the first loop) and could result in some indexes
being skipped. Because of this the function needs to readjust the event
length and index count after filling in the response array.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: SMP: Fix setting unknown auth_req bits

2012-10-31T17:10:20+00:00

commit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2012-09-22T16:19:22+00:00

net: change return values from -EACCES to -EPERM

2012-09-21T17:58:08+00:00

Change return value from -EACCES to -EPERM when the permission check fails.

Signed-off-by: Zhao Hongjiang 
Signed-off-by: David S. Miller

Bluetooth: Fix not removing power_off delayed work

2012-09-18T23:13:02+00:00

For example, when a usb reset is received (I could reproduce it
running something very similar to this[1] in a loop) it could be
that the device is unregistered while the power_off delayed work
is still scheduled to run.

Backtrace:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: To Be Filled By O.E.M.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
Call Trace:
 [] ? free_obj_work+0x57/0x91
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x259/0x259
 [] ? debug_check_no_obj_freed+0x6f/0x1b5
 [] debug_check_no_obj_freed+0x98/0x1b5
 [] ? bt_host_release+0x10/0x1e [bluetooth]
 [] kfree+0x90/0xe6
 [] bt_host_release+0x10/0x1e [bluetooth]
 [] device_release+0x4a/0x7e
 [] kobject_release+0x11d/0x154
 [] kobject_put+0x4a/0x4f
 [] put_device+0x12/0x14
 [] hci_free_dev+0x22/0x26 [bluetooth]
 [] btusb_disconnect+0x96/0x9f [btusb]
 [] usb_unbind_interface+0x57/0x106
 [] __device_release_driver+0x83/0xd6
 [] device_release_driver+0x20/0x2d
 [] usb_driver_release_interface+0x44/0x7b
 [] usb_forced_unbind_intf+0x45/0x4e
 [] usb_reset_device+0xa6/0x12e
 [] usbdev_do_ioctl+0x319/0xe20
 [] ? avc_has_perm_flags+0xc9/0x12e
 [] ? avc_has_perm_flags+0x25/0x12e
 [] ? do_page_fault+0x31e/0x3a1
 [] usbdev_ioctl+0x9/0xd
 [] vfs_ioctl+0x21/0x34
 [] do_vfs_ioctl+0x408/0x44b
 [] ? file_has_perm+0x76/0x81
 [] sys_ioctl+0x51/0x76
 [] system_call_fastpath+0x16/0x1b

[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c

Signed-off-by: Vinicius Costa Gomes 
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan

Bluetooth: Fix freeing uninitialized delayed works

2012-09-18T23:07:04+00:00

When releasing L2CAP socket which is in BT_CONFIG state l2cap_chan_close
invokes l2cap_send_disconn_req which cancel delayed works which are only
set in BT_CONNECTED state with l2cap_ertm_init. Add state check before
cancelling those works.

...
[ 9668.574372] [21085] l2cap_sock_release: sock cd065200, sk f073e800
[ 9668.574399] [21085] l2cap_sock_shutdown: sock cd065200, sk f073e800
[ 9668.574411] [21085] l2cap_chan_close: chan f073ec00 state BT_CONFIG sk f073e800
[ 9668.574421] [21085] l2cap_send_disconn_req: chan f073ec00 conn ecc16600
[ 9668.574441] INFO: trying to register non-static key.
[ 9668.574443] the code is fine but needs lockdep annotation.
[ 9668.574446] turning off the locking correctness validator.
[ 9668.574450] Pid: 21085, comm: obex-client Tainted: G           O 3.5.0+ #57
[ 9668.574452] Call Trace:
[ 9668.574463]  [] __lock_acquire+0x12e3/0x1700
[ 9668.574468]  [] ? trace_hardirqs_on+0xb/0x10
[ 9668.574476]  [] ? printk+0x4d/0x4f
[ 9668.574479]  [] lock_acquire+0x88/0x130
[ 9668.574487]  [] ? try_to_del_timer_sync+0x60/0x60
[ 9668.574491]  [] del_timer_sync+0x50/0xc0
[ 9668.574495]  [] ? try_to_del_timer_sync+0x60/0x60
[ 9668.574515]  [] l2cap_send_disconn_req+0xe3/0x160 [bluetooth]
...

Signed-off-by: Andrei Emeltchenko 
Signed-off-by: Gustavo Padovan

Bluetooth: mgmt: Fix enabling LE while powered off

2012-09-18T23:07:03+00:00

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
write changes to controller. As a result it's not possible to start device
discovery session on LE controller as it uses interleaved discovery which
requires LE Supported Host flag in extended features.

This patch ensures HCI Write LE Host Supported is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Cc: stable@vger.kernel.org
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan

Bluetooth: mgmt: Fix enabling SSP while powered off

2012-09-18T23:07:03+00:00

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
write changes to controller. As a result remote devices won't use Secure Simple
Pairing with our device due to SSP Host Support flag disabled in extended
features and may also reject SSP attempt from our side (with possible fallback
to legacy pairing).

This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Cc: stable@vger.kernel.org
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2012-09-07T18:38:50+00:00

John W. Linville says:

====================
Please pull these fixes intended for 3.6.  There are more commits
here than I would like -- I got a bit behind while I was stalking
Steven Rostedt in San Diego last week...  I'll slow it down after this!

There are a couple of pulls here.  One is from Johannes:

"Please pull (according to the below information) to get a few fixes.

 * a fix to properly disconnect in the driver when authentication or
   association fails
 * a fix to prevent invalid information about mesh paths being reported
   to userspace
 * a memory leak fix in an nl80211 error path"

The other comes via Gustavo:

"A few updates for the 3.6 kernel. There are two btusb patches to add
more supported devices through the new USB_VENDOR_AND_INTEFACE_INFO()
macro and another one that add a new device id for a Sony Vaio laptop,
one fix for a user-after-free and, finally, two patches from Vinicius
to fix a issue in SMP pairing."

Along with those...

Arend van Spriel provides a fix for a use-after-free bug in brcmfmac.

Daniel Drake avoids a hang by not trying to touch the libertas hardware
duing suspend if it is already powered-down.

Felix Fietkau provides a batch of ath9k fixes that adress some
potential problems with power settings, as well as a fix to avoid a
potential interrupt storm.

Gertjan van Wingerde provides a register-width fix for rt2x00, and
a rt2x00 fix to prevent incorrectly detecting the rfkill status.
He also provides a device ID patch.

Hante Meuleman gives us three brcmfmac fixes, one that properly
initializes a command structure, one that fixes a race condition that
could lose usb requests, and one that removes some log spam.

Marc Kleine-Budde offers an rt2x00 fix for a voltage setting on some
specific devices.

Mohammed Shafi Shajakhan sent an ath9k fix to avoid a crash related to
using timers that aren't allocated when 2 wire bluetooth coexistence
hardware is in use.

Sergei Poselenov changes rt2800usb to do some validity checking for
received packets, avoiding crashes on an ARM Soc.

Stone Piao gives us an mwifiex fix for an incorrectly set skb length
value for a command buffer.

All of these are localized to their specific drivers, and relatively
small.  The power-related patches from Felix are bigger than I would
like, but I merged them in consideration of their isolation to ath9k
and the sensitive nature of power settings in wireless devices.
====================

Signed-off-by: David S. Miller

Bluetooth: Fix sending a HCI Authorization Request over LE links

2012-08-27T15:11:51+00:00

In the case that the link is already in the connected state and a
Pairing request arrives from the mgmt interface, hci_conn_security()
would be called but it was not considering LE links.

Reported-by: João Paulo Rechi Vita 
Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan