linux.git/net/bluetooth, branch v4.2-rc5

Bluetooth: Fix NULL pointer dereference in smp_conn_security

2015-07-23T14:41:24+00:00

The l2cap_conn->smp pointer may be NULL for various valid reasons where SMP has
failed to initialize properly. One such scenario is when crypto support is
missing, another when the adapter has been powered on through a legacy method.
The smp_conn_security() function should have the appropriate check for this
situation to avoid NULL pointer dereferences.

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann 
Cc: stable@vger.kernel.org # 4.0+

bluetooth: fix list handling

2015-07-05T02:11:33+00:00

Commit 835a6a2f8603 ("Bluetooth: Stop sabotaging list poisoning")
thought that the code was sabotaging the list poisoning when NULL'ing
out the list pointers and removed it.

But what was going on was that the bluetooth code was using NULL
pointers for the list as a way to mark it empty, and that commit just
broke it (and replaced the test with NULL with a "list_empty()" test on
a uninitialized list instead, breaking things even further).

So fix it all up to use the regular and real list_empty() handling
(which does not use NULL, but a pointer to itself), also making sure to
initialize the list properly (the previous NULL case was initialized
implicitly by the session being allocated with kzalloc())

This is a combination of patches by Marcel Holtmann and Tedd Ho-Jeong
An.

[ I would normally expect to get this through the bt tree, but I'm going
  to release -rc1, so I'm just committing this directly   - Linus ]

Reported-and-tested-by: Jörg Otte 
Cc: Alexey Dobriyan 
Original-by: Tedd Ho-Jeong An 
Original-by: Marcel Holtmann :
Signed-off-by: Linus Torvalds

Bluetooth: Fix warning of potentially uninitialized adv_instance variable

2015-06-18T18:05:31+00:00

Rework the logic of checking for a valid adv_instance for non-zero
cp->instance values. Without this change we may get (false positive)
warnings as follows:

>> net/bluetooth/mgmt.c:7294:29: warning: 'adv_instance' may be used
uninitialized in this function [-Wuninitialized]

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann

Bluetooth: Use zalloc when possible

2015-06-18T18:00:06+00:00

Use zallog for adv_instance allocation instead of kmalloc + memset.
This also fixes the following coccinelle warning:

>> net/bluetooth/hci_core.c:2693:17-24: WARNING: kzalloc should be
used for adv_instance, instead of kmalloc/memset

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann

Bluetooth: Increment management interface revision

2015-06-18T17:11:46+00:00

This patch increments the management interface revision due to
introduction of new multi-advertising feature and various bug fixes.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: hci_core: remove obsolete adv_instance

2015-06-18T16:11:53+00:00

Now that the obsolete adv_instance is no longer being referenced
anywhere in the code it can be removed without breaking the build.

Signed-off-by: Florian Grandel 
Signed-off-by: Marcel Holtmann

Bluetooth: mgmt: multi-adv for mgmt_reenable_advertising()

2015-06-18T16:11:53+00:00

During service discovery, advertising will be disabled. This patch
ensures that it is correctly being re-enabled, both for configuration
made via set advertising and add advertising, once the scanning
times out.

Signed-off-by: Florian Grandel 
Signed-off-by: Marcel Holtmann

Bluetooth: mgmt: multi-adv for trigger_le_scan()

2015-06-18T16:11:53+00:00

This patch ensures that instance advertising is correctly canceled
before starting a le scan.

Signed-off-by: Florian Grandel 
Signed-off-by: Marcel Holtmann

Bluetooth: mgmt: program multi-adv on power on

2015-06-18T16:11:52+00:00

Advertising instances programmed while powered off should be advertised
once the device is powered. This patch ensures that all combinations
of setting and/or adding advertising configuration while powered off
will be correctly activated on power on.

Signed-off-by: Florian Grandel 
Signed-off-by: Marcel Holtmann

Bluetooth: mgmt: multi adv for remove_advertising*()

2015-06-18T16:11:52+00:00

The remove_advertising() and remove_advertising_complete() functions
had instance identifiers hard coded. Notably, when passing in 0x00 as
an instance identifier to signal that all instances should be removed
then the mgmt API would return a hard coded 0x01 rather than returning
the expected value 0x00. This bug is being fixed by always referencing
the instance identifier from the management API call instead.

remove_advertising() is refactored to use the new dynamic advertising
instance list. The logic is being changed to make multi-instance
advertising actually work, notably the schedule_adv_instance() method is
being referenced to make sure that other instances will continue to
advertise even if one instance is being removed.

The code is made more readable by factoring advertising instance
management and initialization into the low-level
hci_remove_adv_instance() and hci_adv_instances_clear() functions.

The method now references the clear_adv_instance() helper method to
remove duplicate logic and code.

Signed-off-by: Florian Grandel 
Signed-off-by: Marcel Holtmann