linux-stable.git/net/bluetooth, branch v3.5.7

Bluetooth: Fix sending a HCI Authorization Request over LE links

2012-10-02T17:39:47+00:00

commit d8343f125710fb596f7a88cd756679f14f4e77b9 upstream.

In the case that the link is already in the connected state and a
Pairing request arrives from the mgmt interface, hci_conn_security()
would be called but it was not considering LE links.

Reported-by: João Paulo Rechi Vita 
Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Change signature of smp_conn_security()

2012-10-02T17:39:47+00:00

commit cc110922da7e902b62d18641a370fec01a9fa794 upstream.

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix use-after-free bug in SMP

2012-10-02T17:39:47+00:00

commit 61a0cfb008f57ecf7eb28ee762952fb42dc15d15 upstream.

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [] ? free_obj_work+0x4a/0x7f
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x241/0x241
 [] debug_check_no_obj_freed+0x92/0x159
 [] slab_free_hook+0x6f/0x77
 [] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [] kfree+0x59/0xac
 [] l2cap_conn_del+0x148/0x157 [bluetooth]
 [] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [] ? trace_hardirqs_on_caller+0x112/0x1ad
 [] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [] hci_rx_work+0x235/0x33c [bluetooth]
 [] ? process_one_work+0x126/0x2fe
 [] process_one_work+0x185/0x2fe
 [] ? process_one_work+0x126/0x2fe
 [] ? lock_acquired+0x1b5/0x1cf
 [] ? le_scan_work+0x11d/0x11d [bluetooth]
 [] ? spin_lock_irq+0x9/0xb
 [] worker_thread+0xcf/0x175
 [] ? rescuer_thread+0x175/0x175
 [] kthread+0x95/0x9d
 [] kernel_threadi_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? flush_kthread_worker+0xdb/0xdb
 [] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: mgmt: Fix enabling LE while powered off

2012-10-02T17:39:24+00:00

commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
write changes to controller. As a result it's not possible to start device
discovery session on LE controller as it uses interleaved discovery which
requires LE Supported Host flag in extended features.

This patch ensures HCI Write LE Host Supported is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix not removing power_off delayed work

2012-10-02T17:39:24+00:00

commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.

For example, when a usb reset is received (I could reproduce it
running something very similar to this[1] in a loop) it could be
that the device is unregistered while the power_off delayed work
is still scheduled to run.

Backtrace:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: To Be Filled By O.E.M.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
Call Trace:
 [] ? free_obj_work+0x57/0x91
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x259/0x259
 [] ? debug_check_no_obj_freed+0x6f/0x1b5
 [] debug_check_no_obj_freed+0x98/0x1b5
 [] ? bt_host_release+0x10/0x1e [bluetooth]
 [] kfree+0x90/0xe6
 [] bt_host_release+0x10/0x1e [bluetooth]
 [] device_release+0x4a/0x7e
 [] kobject_release+0x11d/0x154
 [] kobject_put+0x4a/0x4f
 [] put_device+0x12/0x14
 [] hci_free_dev+0x22/0x26 [bluetooth]
 [] btusb_disconnect+0x96/0x9f [btusb]
 [] usb_unbind_interface+0x57/0x106
 [] __device_release_driver+0x83/0xd6
 [] device_release_driver+0x20/0x2d
 [] usb_driver_release_interface+0x44/0x7b
 [] usb_forced_unbind_intf+0x45/0x4e
 [] usb_reset_device+0xa6/0x12e
 [] usbdev_do_ioctl+0x319/0xe20
 [] ? avc_has_perm_flags+0xc9/0x12e
 [] ? avc_has_perm_flags+0x25/0x12e
 [] ? do_page_fault+0x31e/0x3a1
 [] usbdev_ioctl+0x9/0xd
 [] vfs_ioctl+0x21/0x34
 [] do_vfs_ioctl+0x408/0x44b
 [] ? file_has_perm+0x76/0x81
 [] sys_ioctl+0x51/0x76
 [] system_call_fastpath+0x16/0x1b

[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: mgmt: Fix enabling SSP while powered off

2012-10-02T17:39:24+00:00

commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
write changes to controller. As a result remote devices won't use Secure Simple
Pairing with our device due to SSP Host Support flag disabled in extended
features and may also reject SSP attempt from our side (with possible fallback
to legacy pairing).

This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: L2CAP - Fix info leak via getsockname()

2012-10-02T17:38:42+00:00

[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]

The L2CAP code fails to initialize the l2_bdaddr_type member of struct
sockaddr_l2 and the padding byte added for alignment. It that for leaks
two bytes kernel stack via the getsockname() syscall. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: RFCOMM - Fix info leak via getsockname()

2012-10-02T17:38:42+00:00

[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]

The RFCOMM code fails to initialize the trailing padding byte of struct
sockaddr_rc added for alignment. It that for leaks one byte kernel stack
via the getsockname() syscall. Add an explicit memset(0) before filling
the structure to avoid the info leak.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)

2012-10-02T17:38:41+00:00

[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]

The RFCOMM code fails to initialize the two padding bytes of struct
rfcomm_dev_list_req inserted for alignment before copying it to
userland. Additionally there are two padding bytes in each instance of
struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
dev_num times two bytes uninitialized kernel heap memory.

Allocate the memory using kzalloc() to fix this issue.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)

2012-10-02T17:38:41+00:00

[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]

The RFCOMM code fails to initialize the key_size member of struct
bt_security before copying it to userland -- that for leaking one
byte kernel stack. Initialize key_size with 0 to avoid the info
leak.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman