linux.git/net/bluetooth/rfcomm, branch v2.6.33

Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket

2010-02-04T00:28:44+00:00

When processing a RFCOMM UA frame when the socket is closed and we were
not the RFCOMM initiator would cause rfcomm_session_put() to be called
twice during rfcomm_process_rx(). This would cause a kernel panic in
rfcomm_session_close() then.

This could be easily reproduced during disconnect with devices such as
Motorola H270 that send RFCOMM UA followed quickly by L2CAP disconnect
request. This trace for this looks like:

2009-09-21 17:22:37.788895 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 20 pf 1 ilen 0 fcs 0x7d
2009-09-21 17:22:37.906204 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:37.933090 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 20 pf 1 ilen 0 fcs 0x57
2009-09-21 17:22:38.636764 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 0 pf 1 ilen 0 fcs 0x9c
2009-09-21 17:22:38.744125 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:38.763687 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 0 pf 1 ilen 0 fcs 0xb6
2009-09-21 17:22:38.783554 > ACL data: handle 1 flags 0x02 dlen 12
   L2CAP(s): Disconn req: dcid 0x0040 scid 0x0041

Avoid calling rfcomm_session_put() twice by skipping this call
in rfcomm_recv_ua() if the socket is closed.

Signed-off-by: Nick Pelly 
Signed-off-by: Marcel Holtmann

Bluetooth: Fix sleeping function in RFCOMM within invalid context

2010-02-03T23:52:18+00:00

With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:

BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P           2.6.32 #31
Call Trace:
   [] __might_sleep+0xf8/0xfa
 [] lock_sock_nested+0x29/0xc4
 [] lock_sock+0xb/0xd [l2cap]
 [] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
 [] ? clockevents_program_event+0x75/0x7e
 [] ? tick_dev_program_event+0x37/0xa5
 [] l2cap_sock_release+0x27/0x67 [l2cap]
 [] sock_release+0x1a/0x67
 [] rfcomm_session_del+0x34/0x53 [rfcomm]
 [] rfcomm_session_put+0x14/0x16 [rfcomm]
 [] rfcomm_session_timeout+0xe/0x1a [rfcomm]
 [] run_timer_softirq+0x1e2/0x29a
 [] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
 [] __do_softirq+0xfe/0x1c5
 [] ? timer_interrupt+0x1a/0x21
 [] call_softirq+0x1c/0x28
 [] do_softirq+0x33/0x6b
 [] irq_exit+0x36/0x85
 [] do_IRQ+0xa6/0xbd
 [] ret_from_intr+0x0/0xa
   [] ? acpi_idle_enter_bm+0x269/0x294
 [] ? acpi_idle_enter_bm+0x25f/0x294
 [] ? cpuidle_idle_call+0x97/0x107
 [] ? cpu_idle+0x53/0xaa
 [] ? rest_init+0x7a/0x7c
 [] ? start_kernel+0x389/0x394
 [] ? x86_64_start_reservations+0xac/0xb0
 [] ? x86_64_start_kernel+0xe4/0xeb

To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.

Signed-off-by: Marcel Holtmann 
Tested-by: David John

Bluetooth: Add RFCOMM option to use L2CAP ERTM mode

2009-12-03T18:34:26+00:00

By default the RFCOMM layer would still use L2CAP basic mode. For testing
purposes this option enables RFCOMM to select enhanced retransmission
mode.

Signed-off-by: Marcel Holtmann

net: pass kern to net_proto_family create function

2009-11-06T06:18:14+00:00

The generic __sock_create function has a kern argument which allows the
security system to make decisions based on if a socket is being created by
the kernel or by userspace.  This patch passes that flag to the
net_proto_family specific create function, so it can do the same thing.

Signed-off-by: Eric Paris 
Acked-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

net: Generalize socket rx gap / receive queue overflow cmsg

2009-10-12T20:26:31+00:00

Create a new socket level option to report number of queue overflows

Recently I augmented the AF_PACKET protocol to report the number of frames lost
on the socket receive queue between any two enqueued frames.  This value was
exported via a SOL_PACKET level cmsg.  AFter I completed that work it was
requested that this feature be generalized so that any datagram oriented socket
could make use of this option.  As such I've created this patch, It creates a
new SOL_SOCKET level option called SO_RXQ_OVFL, which when enabled exports a
SOL_SOCKET level cmsg that reports the nubmer of times the sk_receive_queue
overflowed between any two given frames.  It also augments the AF_PACKET
protocol to take advantage of this new feature (as it previously did not touch
sk->sk_drops, which this patch uses to record the overflow count).  Tested
successfully by me.

Notes:

1) Unlike my previous patch, this patch simply records the sk_drops value, which
is not a number of drops between packets, but rather a total number of drops.
Deltas must be computed in user space.

2) While this patch currently works with datagram oriented protocols, it will
also be accepted by non-datagram oriented protocols. I'm not sure if thats
agreeable to everyone, but my argument in favor of doing so is that, for those
protocols which aren't applicable to this option, sk_drops will always be zero,
and reporting no drops on a receive queue that isn't used for those
non-participating protocols seems reasonable to me.  This also saves us having
to code in a per-protocol opt in mechanism.

3) This applies cleanly to net-next assuming that commit
977750076d98c7ff6cbda51858bb5a5894a9d9ab (my af packet cmsg patch) is reverted

Signed-off-by: Neil Horman 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: mark net_proto_ops as const

2009-10-07T08:10:46+00:00

All usages of structure net_proto_ops should be declared const.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

net: Make setsockopt() optlen be unsigned.

2009-09-30T23:12:20+00:00

This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.

Signed-off-by: David S. Miller

Bluetooth: Fix rejected connection not disconnecting ACL link

2009-08-22T22:05:58+00:00

When using DEFER_SETUP on a RFCOMM socket, a SABM frame triggers
authorization which when rejected send a DM response. This is fine
according to the RFCOMM spec:

    the responding implementation may replace the "proper" response
    on the Multiplexer Control channel with a DM frame, sent on the
    referenced DLCI to indicate that the DLCI is not open, and that
    the responder would not grant a request to open it later either.

But some stacks doesn't seems to cope with this leaving DLCI 0 open after
receiving DM frame.

To fix it properly a timer was introduced to rfcomm_session which is used
to set a timeout when the last active DLC of a session is unlinked, this
will give the remote stack some time to reply with a proper DISC frame on
DLCI 0 avoiding both sides sending DISC to each other on stacks that
follow the specification and taking care of those who don't by taking
down DLCI 0.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann

Bluetooth: Coding style cleanup from previous rfcomm_init bug fix

2009-08-22T21:49:36+00:00

The rfcomm_init bug fix went into the kernel premature before it got fully
reviewed and acknowledged by the Bluetooth maintainer. So fix up the coding
style now.

Signed-off-by: Marcel Holtmann

bluetooth: rfcomm_init bug fix

2009-08-03T20:24:39+00:00

rfcomm tty may be used before rfcomm_tty_driver initilized,
The problem is that now socket layer init before tty layer, if userspace
program do socket callback right here then oops will happen.

reporting in:
http://marc.info/?l=linux-bluetooth&m=124404919324542&w=2

make 3 changes:
1. remove #ifdef in rfcomm/core.c,
make it blank function when rfcomm tty not selected in rfcomm.h

2. tune the rfcomm_init error patch to ensure
tty driver initilized before rfcomm socket usage.

3. remove __exit for rfcomm_cleanup_sockets
because above change need call it in a __init function.

Reported-by: Oliver Hartkopp 
Tested-by: Oliver Hartkopp 
Signed-off-by: Dave Young 
Signed-off-by: David S. Miller