linux.git/net/bluetooth/rfcomm, branch v2.6.23

[IRDA]: Fix rfcomm use-after-free

2007-07-31T09:28:05+00:00

Adrian Bunk wrote:
> Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following
> use-after-free in net/bluetooth/rfcomm/tty.c:
>
> <--  snip  -->
>
> ...
> static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
> {
> ...
>         if (IS_ERR(dev->tty_dev)) {
>                 list_del(&dev->list);
>                 kfree(dev);
>                 return PTR_ERR(dev->tty_dev);
>         }
> ...
>
> <--  snip  -->
>
> Spotted by the Coverity checker.

really good catch. I fully overlooked that one. The attached patch
should fix it.

Signed-off-by: Marcel Holtmann 
Signed-off-by: David S. Miller

Freezer: make kernel threads nonfreezable by default

2007-07-17T17:23:02+00:00

Currently, the freezer treats all tasks as freezable, except for the kernel
threads that explicitly set the PF_NOFREEZE flag for themselves.  This
approach is problematic, since it requires every kernel thread to either
set PF_NOFREEZE explicitly, or call try_to_freeze(), even if it doesn't
care for the freezing of tasks at all.

It seems better to only require the kernel threads that want to or need to
be frozen to use some freezer-related code and to remove any
freezer-related code from the other (nonfreezable) kernel threads, which is
done in this patch.

The patch causes all kernel threads to be nonfreezable by default (ie.  to
have PF_NOFREEZE set by default) and introduces the set_freezable()
function that should be called by the freezable kernel threads in order to
unset PF_NOFREEZE.  It also makes all of the currently freezable kernel
threads call set_freezable(), so it shouldn't cause any (intentional)
change of behaviour to appear.  Additionally, it updates documentation to
describe the freezing of tasks more accurately.

[akpm@linux-foundation.org: build fixes]
Signed-off-by: Rafael J. Wysocki 
Acked-by: Nigel Cunningham 
Cc: Pavel Machek 
Cc: Oleg Nesterov 
Cc: Gautham R Shenoy 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[Bluetooth] Keep rfcomm_dev on the list until it is freed

2007-07-11T05:06:51+00:00

This patch changes the RFCOMM TTY release process so that the TTY is kept
on the list until it is really freed. A new device flag is used to keep
track of released TTYs.

Signed-off-by: Ville Tervo 
Signed-off-by: Marcel Holtmann

[Bluetooth] Hangup TTY before releasing rfcomm_dev

2007-07-11T05:01:26+00:00

The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.

Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509

Acked-by: Alan Cox 
Signed-off-by: Marcel Holtmann

[Bluetooth] Disconnect L2CAP connection after last RFCOMM DLC

2007-05-04T22:36:13+00:00

The RFCOMM specification says that the device closing the last DLC on
a particular session is responsible for closing the multiplexer by
closing the corresponding L2CAP channel.

Signed-off-by: Ville Tervo 
Signed-off-by: Marcel Holtmann

[Bluetooth] Check that device is in rfcomm_dev_list before deleting

2007-05-04T22:36:10+00:00

If RFCOMM_RELEASE_ONHUP flag is on and rfcomm_release_dev is called
before connection is closed, rfcomm_dev is deleted twice from the
rfcomm_dev_list and refcount is messed up. This patch adds a check
before deleting device that the device actually is listed.

Signed-off-by: Ville Tervo 
Signed-off-by: Marcel Holtmann

[Bluetooth] Use in-kernel sockets API

2007-05-04T22:36:06+00:00

The kernel provides a new convenient way to access the sockets API for
in-kernel users. It is a good idea to actually use it.

Signed-off-by: Marcel Holtmann

[BLUETOOTH] rfcomm_worker(): fix wakeup race

2007-04-26T08:41:01+00:00

Set TASK_INTERRUPTIBLE prior to testing the flag to avoid missed wakeups.

Signed-off-by: Andrew Morton 
Acked-by: Marcel Holtmann 
Signed-off-by: David S. Miller

[SK_BUFF]: Convert skb->tail to sk_buff_data_t

2007-04-26T05:26:28+00:00

So that it is also an offset from skb->head, reduces its size from 8 to 4 bytes
on 64bit architectures, allowing us to combine the 4 bytes hole left by the
layer headers conversion, reducing struct sk_buff size to 256 bytes, i.e. 4
64byte cachelines, and since the sk_buff slab cache is SLAB_HWCACHE_ALIGN...
:-)

Many calculations that previously required that skb->{transport,network,
mac}_header be first converted to a pointer now can be done directly, being
meaningful as offsets or pointers.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[Bluetooth] Make use of device_move() for RFCOMM TTY devices

2007-02-26T19:42:41+00:00

In the case of bound RFCOMM TTY devices the parent is not available
before its usage. So when opening a RFCOMM TTY device, move it to
the corresponding ACL device as a child. When closing the device,
move it back to the virtual device tree.

Signed-off-by: Marcel Holtmann