linux-stable.git/net/bluetooth, branch v4.12.2

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07T19:53:24+00:00

Network devices can allocate reasources and private memory using
netdev_ops->ndo_init().  However, the release of these resources
can occur in one of two different places.

Either netdev_ops->ndo_uninit() or netdev->destructor().

The decision of which operation frees the resources depends upon
whether it is necessary for all netdev refs to be released before it
is safe to perform the freeing.

netdev_ops->ndo_uninit() presumably can occur right after the
NETDEV_UNREGISTER notifier completes and the unicast and multicast
address lists are flushed.

netdev->destructor(), on the other hand, does not run until the
netdev references all go away.

Further complicating the situation is that netdev->destructor()
almost universally does also a free_netdev().

This creates a problem for the logic in register_netdevice().
Because all callers of register_netdevice() manage the freeing
of the netdev, and invoke free_netdev(dev) if register_netdevice()
fails.

If netdev_ops->ndo_init() succeeds, but something else fails inside
of register_netdevice(), it does call ndo_ops->ndo_uninit().  But
it is not able to invoke netdev->destructor().

This is because netdev->destructor() will do a free_netdev() and
then the caller of register_netdevice() will do the same.

However, this means that the resources that would normally be released
by netdev->destructor() will not be.

Over the years drivers have added local hacks to deal with this, by
invoking their destructor parts by hand when register_netdevice()
fails.

Many drivers do not try to deal with this, and instead we have leaks.

Let's close this hole by formalizing the distinction between what
private things need to be freed up by netdev->destructor() and whether
the driver needs unregister_netdevice() to perform the free_netdev().

netdev->priv_destructor() performs all actions to free up the private
resources that used to be freed by netdev->destructor(), except for
free_netdev().

netdev->needs_free_netdev is a boolean that indicates whether
free_netdev() should be done at the end of unregister_netdevice().

Now, register_netdevice() can sanely release all resources after
ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
and netdev->priv_destructor().

And at the end of unregister_netdevice(), we invoke
netdev->priv_destructor() and optionally call free_netdev().

Signed-off-by: David S. Miller

Bluetooth: Add selftest for ECDH key generation

2017-04-30T13:52:43+00:00

Since the ECDH key generation takes a different path, it needs to be
tested as well. For this generate the public debug key from the private
debug key and compare both.

This also moves the seeding of the private key into the SMP calling code
to allow for easier re-use of the ECDH key generation helper.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: zero kpp input for key generation

2017-04-30T13:52:39+00:00

When generating new ECDH keys with kpp, the shared secret input needs to
be set to NULL. Fix this by including kpp_request_set_input call.

Fixes: 58771c1c ("Bluetooth: convert smp and selftest to crypto kpp
API")
Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Fix user channel for 32bit userspace on 64bit kernel

2017-04-30T10:22:14+00:00

Running 32bit userspace on 64bit kernel results in MSG_CMSG_COMPAT being
defined as 0x80000000. This results in sendmsg failure if used from 32bit
userspace running on 64bit kernel. Fix this by accounting for MSG_CMSG_COMPAT
in flags check in hci_sock_sendmsg.

Signed-off-by: Szymon Janc 
Signed-off-by: Marko Kiiskila 
Signed-off-by: Marcel Holtmann 
Cc: stable@vger.kernel.org

Bluetooth: allocate data for kpp on heap

2017-04-30T10:22:05+00:00

Bluetooth would crash when computing ECDH keys with kpp
if VMAP_STACK is enabled. Fix by allocating data passed
to kpp on heap.

Fixes: 58771c1c ("Bluetooth: convert smp and selftest to crypto kpp
API")
Signed-off-by: Salvatore Benedetto 
Signed-off-by: Marcel Holtmann

Bluetooth: convert smp and selftest to crypto kpp API

2017-04-25T02:53:42+00:00

* Convert both smp and selftest to crypto kpp API
* Remove module ecc as no more required
* Add ecdh_helper functions for wrapping kpp async calls

This patch has been tested *only* with selftest, which is called on
module loading.

Signed-off-by: Salvatore Benedetto 
Signed-off-by: Marcel Holtmann

bluetooth: Do not set IFF_POINTOPOINT

2017-04-12T20:02:41+00:00

The IPv6 stack needs to send and receive Neighbor Discovery
messages. Remove the IFF_POINTOPOINT flag.

Signed-off-by: Patrik Flykt 
Acked-by: Jukka Rissanen 
Reviewed-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann

Bluetooth: 6lowpan: Set tx_queue_len to DEFAULT_TX_QUEUE_LEN

2017-04-12T20:02:41+00:00

Make netdev queue packets if we run out of credits.

Signed-off-by: Luiz Augusto von Dentz 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann

Bluetooth: L2CAP: Add l2cap_le_flowctl_send

2017-04-12T20:02:41+00:00

Consolidate code sending data to LE CoC channels and adds proper
accounting of packets sent, the remaining credits and how many packets
are queued.

Signed-off-by: Luiz Augusto von Dentz 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann

Bluetooth: 6lowpan: Use netif APIs to flow control

2017-04-12T20:02:40+00:00

Rely on netif_wake_queue and netif_stop_queue to flow control when
transmit resources are unavailable.

Signed-off-by: Luiz Augusto von Dentz 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann