linux.git/net/bluetooth/l2cap.c, branch v2.6.34

bluetooth: handle l2cap_create_connless_pdu() errors

2010-04-28T00:03:36+00:00

l2cap_create_connless_pdu() can sometimes return ERR_PTR(-ENOMEM) or
ERR_PTR(-EFAULT).

Signed-off-by: Dan Carpenter 
Acked-by: Marcel Holtmann 
Signed-off-by: David S. Miller

net: check the length of the socket address passed to connect(2)

2010-04-02T00:26:01+00:00

check the length of the socket address passed to connect(2).

Check the length of the socket address passed to connect(2). If the
length is invalid, -EINVAL will be returned.

Signed-off-by: Changli Gao 
----
net/bluetooth/l2cap.c | 3 ++-
net/bluetooth/rfcomm/sock.c | 3 ++-
net/bluetooth/sco.c | 3 ++-
net/can/bcm.c | 3 +++
net/ieee802154/af_ieee802154.c | 3 +++
net/ipv4/af_inet.c | 5 +++++
net/netlink/af_netlink.c | 3 +++
7 files changed, 20 insertions(+), 3 deletions(-)
Signed-off-by: David S. Miller

Bluetooth: Fix kernel crash on L2CAP stress tests

2010-03-21T04:49:36+00:00

Added very simple check that req buffer has enough space to
fit configuration parameters. Shall be enough to reject packets
with configuration size more than req buffer.

Crash trace below

[ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
[ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
...
[ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
[ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
...
[ 6070.030303] Backtrace:
[ 6070.032806] [] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
[] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
[ 6070.043823]  r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
[ 6070.050659] [] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
[] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
[ 6070.061798] [] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
[] (hci_rx_task+0x244/0x478 [bluetooth])
[ 6070.072631]  r6:dc647700 r5:00000001 r4:df2ab740
[ 6070.077362] [] (hci_rx_task+0x0/0x478 [bluetooth]) from
[] (tasklet_action+0x78/0xd8)
[ 6070.087005] [] (tasklet_action+0x0/0xd8) from []

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Convert debug files to actually use debugfs instead of sysfs

2010-03-21T04:49:35+00:00

Some of the debug files ended up wrongly in sysfs, because at that point
of time, debugfs didn't exist. Convert these files to use debugfs and
also seq_file. This patch converts all of these files at once and then
removes the exported symbol for the Bluetooth sysfs class.

Signed-off-by: Marcel Holtmann

Bluetooth: Fix potential bad memory access with sysfs files

2010-03-21T04:49:32+00:00

When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.

Based on initial patches from Neil Brown and Linus Torvalds

Reported-by: Neil Brown 
Signed-off-by: Marcel Holtmann

driver-core: Add attribute argument to class_attribute show/store

2010-03-08T01:04:48+00:00

Passing the attribute to the low level IO functions allows all kinds
of cleanups, by sharing low level IO code without requiring
an own function for every piece of data.

Also drivers can extend the attributes with own data fields
and use that in the low level function.

This makes the class attributes the same as sysdev_class attributes
and plain attributes.

This will allow further cleanups in drivers.

Full tree sweep converting all users.

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix memory leak in L2CAP

2010-01-30T13:57:20+00:00

Move skb_clone after error confition check so it is not going
potentially out of the scope.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Remove double free of SKB pointer in L2CAP

2010-01-30T13:57:11+00:00

Trivial fix for double free of SKB pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Fix L2CAP locking scheme regression

2009-12-17T20:07:25+00:00

When locking was introduced the error path branch was not taken
into account. Error was found in sparse code checking. Kudos to
Jani Nikula.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Ack L2CAP I-frames before retransmit missing packet

2009-12-17T20:06:23+00:00

Moving the Ack to before l2cap_retransmit_frame() we can avoid the
case where txWindow is full and the packet can't be retransmited.

Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann