linux.git/net/bluetooth/l2cap_core.c, branch v3.5

Bluetooth: Fix using uninitialized option in RFCMode

2012-06-12T02:50:28+00:00

If remote device sends bogus RFC option with invalid length,
undefined options values are used. Fix this by using defaults when
remote misbehaves.

This also fixes the following warning reported by gcc 4.7.0:

net/bluetooth/l2cap_core.c: In function 'l2cap_config_rsp':
net/bluetooth/l2cap_core.c:3302:13: warning: 'rfc.max_pdu_size' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.max_pdu_size' was declared here
net/bluetooth/l2cap_core.c:3298:25: warning: 'rfc.monitor_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.monitor_timeout' was declared here
net/bluetooth/l2cap_core.c:3297:25: warning: 'rfc.retrans_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.retrans_timeout' was declared here
net/bluetooth/l2cap_core.c:3295:2: warning: 'rfc.mode' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.mode' was declared here

Signed-off-by: Szymon Janc 
Signed-off-by: Gustavo Padovan

Bluetooth: Fix deadlock and crash when SMP pairing times out

2012-06-08T06:23:56+00:00

The l2cap_conn_del function tries to cancel_sync the security timer, but
when it's called from the timeout function itself a deadlock occurs.
Subsequently the "hcon->l2cap_data = NULL" that's supposed to protect
multiple calls to l2cap_conn_del never gets cleared and when the
connection finally drops we double free's etc which will crash the
kernel.

This patch fixes the issue by using the HCI_CONN_LE_SMP_PEND for
protecting against this. The same flag is also used for the same purpose
in other places in the SMP code.

Signed-off-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan

Bluetooth: Create flags for bt_sk()

2012-05-16T19:14:17+00:00

defer_setup and suspended are now flags into bt_sk().

Signed-off-by: Gustavo Padovan 
Signed-off-by: Johan Hedberg

Bluetooth: Restore locking semantics when looking up L2CAP channels

2012-05-16T19:13:51+00:00

As the comment for l2cap_get_chan_by_scid indicated, the function used
to return a locked socket.  The lock for the socket was acquired while
the channel list was also locked.

When locking was moved over to the l2cap_chan structure, the channel
lock was no longer acquired with the channel list still locked.  This
made it possible for the l2cap_chan to be deleted after
conn->chan_lock was released but before l2cap_chan_lock was called.
Making the call to l2cap_chan_lock before releasing conn->chan_lock
makes it impossible for the l2cap_chan to be deleted at the wrong
time.

Signed-off-by: Mat Martineau 
Reviewed-by: Ulisses Furquim 
Signed-off-by: Gustavo Padovan

Bluetooth: Fix a redundant and problematic incoming MTU check

2012-05-16T19:13:37+00:00

The L2CAP MTU for incoming data is verified differently depending on
the L2CAP mode, so the check is best performed in a mode-specific
context.  Checking the incoming MTU before HCI fragment reassembly is
a layer violation and assumes all bytes after the standard L2CAP
header are L2CAP data.

This approach causes issues with unsegmented ERTM or streaming mode
frames, where there are additional enhanced or extended headers before
the data payload and possible FCS bytes after the data payload.  A
valid frame could be as many as 10 bytes larger than the MTU.

Removing this code is the best fix, because the MTU is checked later
on for all L2CAP data frames (connectionless, basic, ERTM, and
streaming).  This also gets rid of outdated locking (socket instead of
l2cap_chan) and an extra lookup of the channel ID.

Signed-off-by: Mat Martineau 
Reviewed-by: Ulisses Furquim 
Signed-off-by: Gustavo Padovan

Bluetooth: improve readability of l2cap_seq_list code

2012-05-16T19:13:06+00:00

Removes one indentation level.

Signed-off-by: Gustavo Padovan 
Signed-off-by: Johan Hedberg

Bluetooth: Fix skb length calculation

2012-05-16T19:12:56+00:00

When we add a fragment to a skb, len and data_len fields need to be
updated.

Signed-off-by: Gustavo Padovan 
Signed-off-by: Johan Hedberg

Bluetooth: Fix wrong set of skb fragments

2012-05-16T19:12:32+00:00

If alloc() fails we let the frags linked list with garbage value (the
err ptr value) in its last element.

Reported-by: Mat Martineau 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Johan Hedberg

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

2012-05-16T19:11:44+00:00

Bluetooth: Initialize the transmit queue for L2CAP streaming mode

2012-05-15T23:28:16+00:00

Commit 105bdf9ec19e729bacdb33861c74fcf3eb39eb37 introduced a
regression in L2CAP streaming mode due to rearranged initialization
code that is shared between ERTM and streaming mode.  This change
makes sure the transmit queue is initialized in both modes.

Signed-off-by: Mat Martineau 
Acked-by: Andrei Emeltchenko 
Signed-off-by: Gustavo Padovan