summaryrefslogtreecommitdiff
path: root/net/bluetooth
AgeCommit message (Collapse)Author
2018-04-14Merge 4.4.128 into android-4.4Greg Kroah-Hartman
Changes in 4.4.128 cfg80211: make RATE_INFO_BW_20 the default md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock rtc: snvs: fix an incorrect check of return value x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION IB/srpt: Fix abort handling af_key: Fix slab-out-of-bounds in pfkey_compile_policy. mac80211: bail out from prep_connection() if a reconfig is ongoing bna: Avoid reading past end of buffer qlge: Avoid reading past end of buffer ipmi_ssif: unlock on allocation failure net: cdc_ncm: Fix TX zero padding net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control lockd: fix lockd shutdown race drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() s390: move _text symbol to address higher than zero net/mlx4_en: Avoid adding steering rules with invalid ring NFSv4.1: Work around a Linux server bug... CIFS: silence lockdep splat in cifs_relock_file() blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op net: qca_spi: Fix alignment issues in rx path netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Input: elan_i2c - check if device is there before really probing Input: elantech - force relative mode on a certain module KVM: PPC: Book3S PR: Check copy_to/from_user return values vmxnet3: ensure that adapter is in proper state during force_close SMB2: Fix share type handling bus: brcmstb_gisb: Use register offsets with writes too bus: brcmstb_gisb: correct support for 64-bit address output PowerCap: Fix an error code in powercap_register_zone() ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning x86/tsc: Provide 'tsc=unstable' boot parameter ARM: dts: imx6qdl-wandboard: Fix audio channel swap ipv6: avoid dad-failures for addresses with NODAD async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() usb: dwc3: keystone: check return value btrfs: fix incorrect error return ret being passed to mapping_set_error ata: libahci: properly propagate return value of platform_get_irq() neighbour: update neigh timestamps iff update is effective arp: honour gratuitous ARP _replies_ usb: chipidea: properly handle host or gadget initialization failure USB: ene_usb6250: fix first command execution net: x25: fix one potential use-after-free issue USB: ene_usb6250: fix SCSI residue overwriting serial: 8250: omap: Disable DMA for console UART serial: sh-sci: Fix race condition causing garbage during shutdown sh_eth: Use platform device for printing before register_netdev() scsi: csiostor: fix use after free in csio_hw_use_fwconfig() powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash ath5k: fix memory leak on buf on failed eeprom read selftests/powerpc: Fix TM resched DSCR test with some compilers xfrm: fix state migration copy replay sequence numbers iio: hi8435: avoid garbage event at first enable iio: hi8435: cleanup reset gpio ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors md-cluster: fix potential lock issue in add_new_disk ARM: davinci: da8xx: Create DSP device only when assigned memory ray_cs: Avoid reading past end of buffer leds: pca955x: Correct I2C Functionality sched/numa: Use down_read_trylock() for the mmap_sem net/mlx5: Tolerate irq_set_affinity_hint() failures selinux: do not check open permission on sockets block: fix an error code in add_partition() mlx5: fix bug reading rss_hash_type from CQE net: ieee802154: fix net_device reference release too early libceph: NULL deref on crush_decode() error path netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() ASoC: rsnd: SSI PIO adjust to 24bit mode scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() fix race in drivers/char/random.c:get_reg() ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() tcp: better validation of received ack sequences net: move somaxconn init from sysctl code Input: elan_i2c - clear INT before resetting controller bonding: Don't update slave->link until ready to commit KVM: nVMX: Fix handling of lmsw instruction net: llc: add lock_sock in llc_ui_bind to avoid a race condition ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node thermal: power_allocator: fix one race condition issue for thermal_instances list perf probe: Add warning message if there is unexpected event name l2tp: fix missing print session offset info rds; Reset rs->rs_bound_addr in rds_add_bound() failure path hwmon: (ina2xx) Make calibration register value fixed media: videobuf2-core: don't go out of the buffer range ASoC: Intel: cht_bsw_rt5645: Analog Mic support scsi: libiscsi: Allow sd_shutdown on bad transport scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. vfb: fix video mode and line_length being set when loaded gpio: label descriptors using the device name ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' wl1251: check return from call to wl1251_acx_arp_ip_filter hdlcdrv: Fix divide by zero in hdlcdrv_ioctl ovl: filter trusted xattr for non-admin powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] dmaengine: imx-sdma: Handle return value of clk_prepare_enable arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage net/mlx5: avoid build warning for uniprocessor cxgb4: FW upgrade fixes rtc: opal: Handle disabled TPO in opal_get_tpo_time() rtc: interface: Validate alarm-time before handling rollover SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() net: freescale: fix potential null pointer dereference KVM: SVM: do not zero out segment attributes if segment is unusable or not present clk: scpi: fix return type of __scpi_dvfs_round_rate clk: Fix __set_clk_rates error print-string powerpc/spufs: Fix coredump of SPU contexts perf trace: Add mmap alias for s390 qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M mISDN: Fix a sleep-in-atomic bug drm/omap: fix tiled buffer stride calculations cxgb4: fix incorrect cim_la output for T6 Fix serial console on SNI RM400 machines bio-integrity: Do not allocate integrity context for bio w/o data skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow sit: reload iphdr in ipip6_rcv net/mlx4: Fix the check in attaching steering rules net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport perf header: Set proper module name when build-id event found perf report: Ensure the perf DSO mapping matches what libdw sees tags: honor COMPILED_SOURCE with apart output directory e1000e: fix race condition around skb_tstamp_tx() cx25840: fix unchecked return values mceusb: sporadic RX truncation corruption fix net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails perf/core: Correct event creation with PERF_FORMAT_GROUP MIPS: mm: fixed mappings: correct initialisation MIPS: mm: adjust PKMAP location MIPS: kprobes: flush_insn_slot should flush only if probe initialised Fix loop device flush before configure v3 net: emac: fix reset timeout with AR8035 phy perf tests: Decompress kernel module before objdump skbuff: only inherit relevant tx_flags xen: avoid type warning in xchg_xen_ulong bnx2x: Allow vfs to disable txvlan offload sctp: fix recursive locking warning in sctp_do_peeloff sparc64: ldc abort during vds iso boot iio: magnetometer: st_magn_spi: fix spi_device_id table Bluetooth: Send HCI Set Event Mask Page 2 command only when needed cpuidle: dt: Add missing 'of_node_put()' ACPICA: Events: Add runtime stub support for event APIs ACPICA: Disassembler: Abort on an invalid/unknown AML opcode s390/dasd: fix hanging safe offline vxlan: dont migrate permanent fdb entries during learn bcache: stop writeback thread after detaching bcache: segregate flash only volume write streams scsi: libsas: fix memory leak in sas_smp_get_phy_events() scsi: libsas: fix error when getting phy events scsi: libsas: initialize sas_phy status according to response of DISCOVER blk-mq: fix kernel oops in blk_mq_tag_idle() tty: n_gsm: Allow ADM response in addition to UA for control dlci EDAC, mv64x60: Fix an error handling path cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages perf tools: Fix copyfile_offset update of output offset ipsec: check return value of skb_to_sgvec always rxrpc: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec in one more location random: use lockless method of accessing and updating f->reg_idx futex: Remove requirement for lock_page() in get_futex_key() Kbuild: provide a __UNIQUE_ID for clang arp: fix arp_filter on l3slave devices net: fix possible out-of-bound read in skb_network_protocol() net/ipv6: Fix route leaking between VRFs netlink: make sure nladdr has correct size in netlink_connect() net/sched: fix NULL dereference in the error path of tcf_bpf_init() pptp: remove a buggy dst release in pptp_connect() sctp: do not leak kernel memory to user space sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 sky2: Increase D3 delay to sky2 stops working after suspend vhost: correctly remove wait queue during poll failure vlan: also check phy_driver ts_info for vlan's real device bonding: fix the err path for dev hwaddr sync in bond_enslave bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave bonding: process the err returned by dev_set_allmulti properly in bond_enslave net: fool proof dev_valid_name() ip_tunnel: better validate user provided tunnel names ipv6: sit: better validate user provided tunnel names ip6_gre: better validate user provided tunnel names ip6_tunnel: better validate user provided tunnel names vti6: better validate user provided tunnel names r8169: fix setting driver_data after register_netdev net sched actions: fix dumping which requires several messages to user space net/ipv6: Increment OUTxxx counters after netfilter hook ipv6: the entire IPv6 header chain must fit the first fragment vrf: Fix use after free and double free in vrf_finish_output Revert "xhci: plat: Register shutdown for xhci_plat" Linux 4.4.128 Change-Id: I9c1e58f634cc18f15a840c9d192c892dfcc5ff73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-13Bluetooth: Send HCI Set Event Mask Page 2 command only when neededMarcel Holtmann
[ Upstream commit 313f6888c8fbb1bc8b36c9012ce4e1de848df696 ] The Broadcom BCM20702 Bluetooth controller in ThinkPad-T530 devices report support for the Set Event Mask Page 2 command, but actually do return an error when trying to use it. < HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0 > HCI Event: Command Complete (0x0e) plen 68 Read Local Supported Commands (0x04|0x0002) ncmd 1 Status: Success (0x00) Commands: 162 entries ... Set Event Mask Page 2 (Octet 22 - Bit 2) ... < HCI Command: Set Event Mask Page 2 (0x03|0x0063) plen 8 Mask: 0x0000000000000000 > HCI Event: Command Complete (0x0e) plen 4 Set Event Mask Page 2 (0x03|0x0063) ncmd 1 Status: Unknown HCI Command (0x01) Since these controllers do not support any feature that would require the event mask page 2 to be modified, it is safe to not send this command at all. The default value is all bits set to zero. T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 9 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0a5c ProdID=21e6 Rev= 1.12 S: Manufacturer=Broadcom Corp S: Product=BCM20702A0 S: SerialNumber=F82FA8E8CFC0 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=btusb E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Reported-by: Sedat Dilek <sedat.dilek@gmail.com> Tested-by: Sedat Dilek <sedat.dilek@gmail.com> Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-08Merge 4.4.127 into android-4.4Greg Kroah-Hartman
Changes in 4.4.127 mtd: jedec_probe: Fix crash in jedec_read_mfr() ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() ALSA: pcm: potential uninitialized return values perf/hwbp: Simplify the perf-hwbp code, fix documentation partitions/msdos: Unable to mount UFS 44bsd partitions usb: gadget: define free_ep_req as universal function usb: gadget: change len to size_t on alloc_ep_req() usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align usb: gadget: align buffer size when allocating for OUT endpoint usb: gadget: f_hid: fix: Prevent accessing released memory kprobes/x86: Fix to set RWX bits correctly before releasing trampoline ACPI, PCI, irq: remove redundant check for null string pointer writeback: fix the wrong congested state variable definition PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant dm ioctl: remove double parentheses Input: mousedev - fix implicit conversion warning netfilter: nf_nat_h323: fix logical-not-parentheses warning genirq: Use cpumask_available() for check of cpumask variable cpumask: Add helper cpumask_available() selinux: Remove unnecessary check of array base in selinux_set_mapping() fs: compat: Remove warning from COMPATIBLE_IOCTL jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp frv: declare jiffies to be located in the .data section audit: add tty field to LOGIN event tty: provide tty_name() even without CONFIG_TTY netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch selinux: Remove redundant check for unknown labeling behavior arm64: avoid overflow in VA_START and PAGE_OFFSET xfrm_user: uncoditionally validate esn replay attribute struct RDMA/ucma: Check AF family prior resolving address RDMA/ucma: Fix use-after-free access in ucma_close RDMA/ucma: Ensure that CM_ID exists prior to access it RDMA/ucma: Check that device is connected prior to access it RDMA/ucma: Check that device exists prior to accessing it RDMA/ucma: Don't allow join attempts for unsupported AF family RDMA/ucma: Introduce safer rdma_addr_size() variants net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems netfilter: bridge: ebt_among: add more missing match size checks netfilter: x_tables: add and use xt_check_proc_name Bluetooth: Fix missing encryption refresh on Security Request llist: clang: introduce member_address_is_nonnull() scsi: virtio_scsi: always read VPD pages for multiqueue too usb: dwc2: Improve gadget state disconnection handling USB: serial: ftdi_sio: add RT Systems VX-8 cable USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator USB: serial: cp210x: add ELDAT Easywave RX09 id mei: remove dev_err message on an unsupported ioctl media: usbtv: prevent double free in error case parport_pc: Add support for WCH CH382L PCI-E single parallel port card. crypto: ahash - Fix early termination in hash walk crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one fs/proc: Stop trying to report thread stacks staging: comedi: ni_mio_common: ack ai fifo error interrupts. Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad vt: change SGR 21 to follow the standards Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition ARM: dts: dra7: Add power hold and power controller properties to palmas ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property md/raid10: reset the 'first' at the end of loop net: hns: Fix ethtool private flags nospec: Move array_index_nospec() parameter checking into separate macro nospec: Kill array_index_nospec_mask_check() Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()" Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin" Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin" Revert "cpufreq: Fix governor module removal race" Revert "mtip32xx: use runtime tag to initialize command header" spi: davinci: fix up dma_mapping_error() incorrect patch net: cavium: liquidio: fix up "Avoid dma_unmap_single on uninitialized ndata" Revert "ip6_vti: adjust vti mtu according to mtu of lower device" Linux 4.4.127 Change-Id: Ia3b9ed0a5b2ea6c682386dbee5337ed8413d1a53 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-08Bluetooth: Fix missing encryption refresh on Security RequestSzymon Janc
commit 64e759f58f128730b97a3c3a26d283c075ad7c86 upstream. If Security Request is received on connection that is already encrypted with sufficient security master should perform encryption key refresh procedure instead of just ignoring Slave Security Request (Core Spec 5.0 Vol 3 Part H 2.4.6). > ACL Data RX: Handle 3585 flags 0x02 dlen 6 SMP: Security Request (0x0b) len 1 Authentication requirement: Bonding, No MITM, SC, No Keypresses (0x09) < HCI Command: LE Start Encryption (0x08|0x0019) plen 28 Handle: 3585 Random number: 0x0000000000000000 Encrypted diversifier: 0x0000 Long term key: 44264272a5c426a9e868f034cf0e69f3 > HCI Event: Command Status (0x0f) plen 4 LE Start Encryption (0x08|0x0019) ncmd 1 Status: Success (0x00) > HCI Event: Encryption Key Refresh Complete (0x30) plen 3 Status: Success (0x00) Handle: 3585 Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-17Merge 4.4.112 into android-4.4Greg Kroah-Hartman
Changes in 4.4.112 dm bufio: fix shrinker scans when (nr_to_scan < retain_target) KVM: Fix stack-out-of-bounds read in write_mmio can: gs_usb: fix return value of the "set_bittiming" callback IB/srpt: Disable RDMA access by the initiator MIPS: Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the task MIPS: Factor out NT_PRFPREG regset access helpers MIPS: Guard against any partial write attempt with PTRACE_SETREGSET MIPS: Consistently handle buffer counter with PTRACE_SETREGSET MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=y kvm: vmx: Scrub hardware GPRs at VM-exit x86/vsdo: Fix build on PARAVIRT_CLOCK=y, KVM_GUEST=n x86/acpi: Handle SCI interrupts above legacy space gracefully iommu/arm-smmu-v3: Don't free page table ops twice ALSA: pcm: Remove incorrect snd_BUG_ON() usages ALSA: pcm: Add missing error checks in OSS emulation plugin builder ALSA: pcm: Abort properly at pending signal in OSS read/write loops ALSA: pcm: Allow aborting mutex lock at OSS read/write loops ALSA: aloop: Release cable upon open error path ALSA: aloop: Fix inconsistent format due to incomplete rule ALSA: aloop: Fix racy hw constraints adjustment x86/acpi: Reduce code duplication in mp_override_legacy_irq() mm/compaction: fix invalid free_pfn and compact_cached_free_pfn mm/compaction: pass only pageblock aligned range to pageblock_pfn_to_page mm/page-writeback: fix dirty_ratelimit calculation mm/zswap: use workqueue to destroy pool zswap: don't param_set_charp while holding spinlock locks: don't check for race with close when setting OFD lock futex: Replace barrier() in unqueue_me() with READ_ONCE() locking/mutex: Allow next waiter lockless wakeup usbvision fix overflow of interfaces array usb: musb: ux500: Fix NULL pointer dereference at system PM r8152: fix the wake event r8152: use test_and_clear_bit r8152: adjust ALDPS function lan78xx: use skb_cow_head() to deal with cloned skbs sr9700: use skb_cow_head() to deal with cloned skbs smsc75xx: use skb_cow_head() to deal with cloned skbs cx82310_eth: use skb_cow_head() to deal with cloned skbs x86/mm/pat, /dev/mem: Remove superfluous error message hwrng: core - sleep interruptible in read sysrq: Fix warning in sysrq generated crash. xhci: Fix ring leak in failure path of xhci_alloc_virt_device() Revert "userfaultfd: selftest: vm: allow to build in vm/ directory" x86/pti/efi: broken conversion from efi to kernel page table 8021q: fix a memory leak for VLAN 0 device ip6_tunnel: disable dst caching if tunnel is dual-stack net: core: fix module type in sock_diag_bind RDS: Heap OOB write in rds_message_alloc_sgs() RDS: null pointer dereference in rds_atomic_free_op sh_eth: fix TSU resource handling sh_eth: fix SH7757 GEther initialization net: stmmac: enable EEE in MII, GMII or RGMII only ipv6: fix possible mem leaks in ipv6_make_skb() crypto: algapi - fix NULL dereference in crypto_remove_spawns() rbd: set max_segments to USHRT_MAX x86/microcode/intel: Extend BDW late-loading with a revision check KVM: x86: Add memory barrier on vmcs field lookup drm/vmwgfx: Potential off by one in vmw_view_add() kaiser: Set _PAGE_NX only if supported bpf: add bpf_patch_insn_single helper bpf: don't (ab)use instructions to store state bpf: move fixup_bpf_calls() function bpf: refactor fixup_bpf_calls() bpf: adjust insn_aux_data when patching insns bpf: prevent out-of-bounds speculation bpf, array: fix overflow in max_entries and undefined behavior in index_mask iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ USB: serial: cp210x: add new device ID ELV ALC 8xxx usb: misc: usb3503: make sure reset is low for at least 100us USB: fix usbmon BUG trigger usbip: remove kernel addresses from usb device and urb debug msgs staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl Bluetooth: Prevent stack info leak from the EFS element. uas: ignore UAS for Norelsys NS1068(X) chips e1000e: Fix e1000_check_for_copper_link_ich8lan return value. x86/Documentation: Add PTI description x86/cpu: Factor out application of forced CPU caps x86/cpufeatures: Make CPU bugs sticky x86/cpufeatures: Add X86_BUG_CPU_INSECURE x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] x86/cpu: Merge bugs.c and bugs_64.c sysfs/cpu: Add vulnerability folder x86/cpu: Implement CPU vulnerabilites sysfs functions sysfs/cpu: Fix typos in vulnerability documentation x86/alternatives: Fix optimize_nops() checking x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm selftests/x86: Add test_vsyscall Linux 4.4.112 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-01-17Bluetooth: Prevent stack info leak from the EFS element.Ben Seri
commit 06e7e776ca4d36547e503279aeff996cbb292c16 upstream. In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes). This issue has been assigned CVE-2017-1000410 Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: Ben Seri <ben@armis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-14Merge 4.4.88 into android-4.4Greg Kroah-Hartman
Changes in 4.4.88 usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard USB: serial: option: add support for D-Link DWM-157 C1 usb: Add device quirk for Logitech HD Pro Webcam C920-C usb:xhci:Fix regression when ATI chipsets detected USB: core: Avoid race of async_completed() w/ usbdev_release() staging/rts5208: fix incorrect shift to extract upper nybble driver core: bus: Fix a potential double free intel_th: pci: Add Cannon Lake PCH-H support intel_th: pci: Add Cannon Lake PCH-LP support ath10k: fix memory leak in rx ring buffer allocation Input: trackpoint - assume 3 buttons when buttons detection fails rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter Bluetooth: Add support of 13d3:3494 RTL8723BE device dlm: avoid double-free on error path in dlm_device_{register,unregister} mwifiex: correct channel stat buffer overflows drm/nouveau/pci/msi: disable MSI on big-endian platforms by default workqueue: Fix flag collision cs5536: add support for IDE controller variant scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE scsi: sg: recheck MMAP_IO request length with lock held drm: adv7511: really enable interrupts for EDID detection drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event() drm/bridge: adv7511: Re-write the i2c address before EDID probing btrfs: resume qgroup rescan on rw remount locktorture: Fix potential memory leak with rw lock test ALSA: msnd: Optimize / harden DSP and MIDI loops Bluetooth: Properly check L2CAP config option output buffer length ARM: 8692/1: mm: abort uaccess retries upon fatal signal NFS: Fix 2 use after free issues in the I/O code xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present Linux 4.4.88 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-09-13Bluetooth: Properly check L2CAP config option output buffer lengthBen Seri
commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream. Validate the output buffer length for L2CAP config requests and responses to avoid overflowing the stack buffer used for building the option blocks. Signed-off-by: Ben Seri <ben@armis.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30Merge 4.4.85 into android-4.4Greg Kroah-Hartman
Changes in 4.4.85 af_key: do not use GFP_KERNEL in atomic contexts dccp: purge write queue in dccp_destroy_sock() dccp: defer ccid_hc_tx_delete() at dismantle time ipv4: fix NULL dereference in free_fib_info_rcu() net_sched/sfq: update hierarchical backlog when drop packet ipv4: better IP_MAX_MTU enforcement sctp: fully initialize the IPv6 address in sctp_v6_to_addr() tipc: fix use-after-free ipv6: reset fn->rr_ptr when replacing route ipv6: repair fib6 tree in failure case tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP irda: do not leak initialized list.dev to userspace net: sched: fix NULL pointer dereference when action calls some targets net_sched: fix order of queue length updates in qdisc_replace() mei: me: add broxton pci device ids mei: me: add lewisburg device ids Input: trackpoint - add new trackpoint firmware ID Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 ALSA: core: Fix unexpected error at replacing user TLV ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses i2c: designware: Fix system suspend drm: Release driver tracking before making the object available again drm/atomic: If the atomic check fails, return its value first drm: rcar-du: lvds: Fix PLL frequency-related configuration drm: rcar-du: lvds: Rename PLLEN bit to PLLON drm: rcar-du: Fix crash in encoder failure error path drm: rcar-du: Fix display timing controller parameter drm: rcar-du: Fix H/V sync signal polarity configuration tracing: Fix freeing of filter in create_filter() when set_str is false cifs: Fix df output for users with quota limits cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() nfsd: Limit end of page list when decoding NFSv4 WRITE perf/core: Fix group {cpu,task} validation Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Bluetooth: cmtp: fix possible might sleep error in cmtp_session Bluetooth: bnep: fix possible might sleep error in bnep_session binder: use group leader instead of open thread binder: Use wake up hint for synchronous transactions. ANDROID: binder: fix proc->tsk check. iio: imu: adis16480: Fix acceleration scale factor for adis16480 iio: hid-sensor-trigger: Fix the race with user space powering up sensors staging: rtl8188eu: add RNX-N150NUB support ASoC: simple-card: don't fail if sysclk setting is not supported ASoC: rsnd: disable SRC.out only when stop timing ASoC: rsnd: avoid pointless loop in rsnd_mod_interrupt() ASoC: rsnd: Add missing initialization of ADG req_rate ASoC: rsnd: ssi: 24bit data needs right-aligned settings ASoC: rsnd: don't call update callback if it was NULL ntb_transport: fix qp count bug ntb_transport: fix bug calculating num_qps_mw ACPI: ioapic: Clear on-stack resource before using it ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal Linux 4.4.85 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-08-30Bluetooth: bnep: fix possible might sleep error in bnep_sessionJeffy Chen
commit 25717382c1dd0ddced2059053e3ca5088665f7a5 upstream. It looks like bnep_session has same pattern as the issue reported in old rfcomm: while (1) { set_current_state(TASK_INTERRUPTIBLE); if (condition) break; // may call might_sleep here schedule(); } __set_current_state(TASK_RUNNING); Which fixed at: dfb2fae Bluetooth: Fix nested sleeps So let's fix it at the same way, also follow the suggestion of: https://lwn.net/Articles/628628/ Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Reviewed-by: Brian Norris <briannorris@chromium.org> Reviewed-by: AL Yu-Chen Cho <acho@suse.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30Bluetooth: cmtp: fix possible might sleep error in cmtp_sessionJeffy Chen
commit f06d977309d09253c744e54e75c5295ecc52b7b4 upstream. It looks like cmtp_session has same pattern as the issue reported in old rfcomm: while (1) { set_current_state(TASK_INTERRUPTIBLE); if (condition) break; // may call might_sleep here schedule(); } __set_current_state(TASK_RUNNING); Which fixed at: dfb2fae Bluetooth: Fix nested sleeps So let's fix it at the same way, also follow the suggestion of: https://lwn.net/Articles/628628/ Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Reviewed-by: Brian Norris <briannorris@chromium.org> Reviewed-by: AL Yu-Chen Cho <acho@suse.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30Bluetooth: hidp: fix possible might sleep error in hidp_session_threadJeffy Chen
commit 5da8e47d849d3d37b14129f038782a095b9ad049 upstream. It looks like hidp_session_thread has same pattern as the issue reported in old rfcomm: while (1) { set_current_state(TASK_INTERRUPTIBLE); if (condition) break; // may call might_sleep here schedule(); } __set_current_state(TASK_RUNNING); Which fixed at: dfb2fae Bluetooth: Fix nested sleeps So let's fix it at the same way, also follow the suggestion of: https://lwn.net/Articles/628628/ Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Tested-by: AL Yu-Chen Cho <acho@suse.com> Tested-by: Rohit Vaswani <rvaswani@nvidia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27Merge 4.4.79 into android-4.4Greg Kroah-Hartman
Changes in 4.4.79 disable new gcc-7.1.1 warnings for now ir-core: fix gcc-7 warning on bool arithmetic s5p-jpeg: don't return a random width/height thermal: cpu_cooling: Avoid accessing potentially freed structures ath9k: fix tx99 use after free ath9k: fix tx99 bus error NFC: fix broken device allocation NFC: nfcmrvl_uart: add missing tty-device sanity check NFC: nfcmrvl: do not use device-managed resources NFC: nfcmrvl: use nfc-device for firmware download NFC: nfcmrvl: fix firmware-management initialisation nfc: Ensure presence of required attributes in the activate_target handler nfc: Fix the sockaddr length sanitization in llcp_sock_connect NFC: Add sockaddr length checks before accessing sa_family in bind handlers perf intel-pt: Move decoder error setting into one condition perf intel-pt: Improve sample timestamp perf intel-pt: Fix missing stack clear perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP perf intel-pt: Clear FUP flag on error Bluetooth: use constant time memory comparison for secret values wlcore: fix 64K page support ASoC: compress: Derive substream from stream based on direction PM / Domains: Fix unsafe iteration over modified list of device links PM / Domains: Fix unsafe iteration over modified list of domain providers scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails. iscsi-target: Add login_keys_workaround attribute for non RFC initiators powerpc/64: Fix atomic64_inc_not_zero() to return an int powerpc: Fix emulation of mcrf in emulate_step() powerpc: Fix emulation of mfocrf in emulate_step() powerpc/asm: Mark cr0 as clobbered in mftb() af_key: Fix sadb_x_ipsecrequest parsing PCI/PM: Restore the status of PCI devices across hibernation ipvs: SNAT packet replies only for NATed connections xhci: fix 20000ms port resume timeout xhci: Fix NULL pointer dereference when cleaning up streams for removed host usb: storage: return on error to avoid a null pointer dereference USB: cdc-acm: add device-id for quirky printer usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL usb: renesas_usbhs: gadget: disable all eps when the driver stops md: don't use flush_signals in userspace processes x86/xen: allow userspace access during hypercalls cx88: Fix regression in initial video standard setting Raid5 should update rdev->sectors after reshape s390/syscalls: Fix out of bounds arguments access drm/amd/amdgpu: Return error if initiating read out of range on vram drm/radeon/ci: disable mclk switching for high refresh rates (v2) drm/radeon: Fix eDP for single-display iMac10,1 (v2) ipmi: use rcu lock around call to intf->handlers->sender() ipmi:ssif: Add missing unlock in error branch f2fs: Don't clear SGID when inheriting ACLs vfio: Fix group release deadlock vfio: New external user group/file match ftrace: Fix uninitialized variable in match_records() MIPS: Fix mips_atomic_set() retry condition MIPS: Fix mips_atomic_set() with EVA MIPS: Negate error syscall return in trace x86/acpi: Prevent out of bound access caused by broken ACPI tables x86/ioapic: Pass the correct data to unmask_ioapic_irq() MIPS: Fix MIPS I ISA /proc/cpuinfo reporting MIPS: Save static registers before sysmips MIPS: Actually decode JALX in `__compute_return_epc_for_insn' MIPS: Fix unaligned PC interpretation in `compute_return_epc' MIPS: math-emu: Prevent wrong ISA mode instruction emulation MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn' MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn' MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn' MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message Input: i8042 - fix crash at boot time NFS: only invalidate dentrys that are clearly invalid. udf: Fix deadlock between writeback and udf_setsize() target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target Revert "perf/core: Drop kernel samples even though :u is specified" staging: rtl8188eu: add TL-WN722N v2 support ceph: fix race in concurrent readdir RDMA/core: Initialize port_num in qp_attr drm/mst: Fix error handling during MST sideband message reception drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req() drm/mst: Avoid processing partially received up/down message transactions of: device: Export of_device_{get_modalias, uvent_modalias} to modules spmi: Include OF based modalias in device uevent tracing: Fix kmemleak in instance_rmdir alarmtimer: don't rate limit one-shot timers Linux 4.4.79 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-27Bluetooth: use constant time memory comparison for secret valuesJason A. Donenfeld
commit 329d82309824ff1082dc4a91a5bbed8c3bec1580 upstream. This file is filled with complex cryptography. Thus, the comparisons of MACs and secret keys and curve points and so forth should not add timing attacks, which could either result in a direct forgery, or, given the complexity, some other type of attack. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-21Merge 4.4.69 into android-4.4Greg Kroah-Hartman
Changes in 4.4.69 xen: adjust early dom0 p2m handling to xen hypervisor behavior target: Fix compare_and_write_callback handling for non GOOD status target/fileio: Fix zero-length READ and WRITE handling target: Convert ACL change queue_depth se_session reference usage iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement usb: host: xhci: print correct command ring address USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously staging: vt6656: use off stack for in buffer USB transfers. staging: vt6656: use off stack for out buffer USB transfers. staging: gdm724x: gdm_mux: fix use-after-free on module unload staging: comedi: jr3_pci: fix possible null pointer dereference staging: comedi: jr3_pci: cope with jiffies wraparound usb: misc: add missing continue in switch usb: Make sure usb/phy/of gets built-in usb: hub: Fix error loop seen after hub communication errors usb: hub: Do not attempt to autosuspend disconnected devices x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug x86, pmem: Fix cache flushing for iovec write < 8 bytes um: Fix PTRACE_POKEUSER on x86_64 KVM: x86: fix user triggerable warning in kvm_apic_accept_events() KVM: arm/arm64: fix races in kvm_psci_vcpu_on block: fix blk_integrity_register to use template's interval_exp if not 0 crypto: algif_aead - Require setkey before accept(2) dm era: save spacemap metadata root after the pre-commit vfio/type1: Remove locked page accounting workqueue IB/core: Fix sysfs registration error flow IB/IPoIB: ibX: failed to create mcg debug file IB/mlx4: Fix ib device initialization error flow IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level ext4: evict inline data when writing to memory map fs/xattr.c: zero out memory copied to userspace in getxattr ceph: fix memory leak in __ceph_setxattr() fs/block_dev: always invalidate cleancache in invalidate_bdev() Set unicode flag on cifs echo request to avoid Mac error SMB3: Work around mount failure when using SMB3 dialect to Macs CIFS: fix mapping of SFM_SPACE and SFM_PERIOD cifs: fix CIFS_IOC_GET_MNT_INFO oops CIFS: add misssing SFM mapping for doublequote padata: free correct variable arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses serial: samsung: Use right device for DMA-mapping calls serial: omap: fix runtime-pm handling on unbind serial: omap: suspend device on probe errors tty: pty: Fix ldisc flush after userspace become aware of the data already Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Bluetooth: hci_bcm: add missing tty-device sanity check Bluetooth: hci_intel: add missing tty-device sanity check mac80211: pass RX aggregation window size to driver mac80211: pass block ack session timeout to to driver mac80211: RX BA support for sta max_rx_aggregation_subframes wlcore: Pass win_size taken from ieee80211_sta to FW wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event ipmi: Fix kernel panic at ipmi_ssif_thread() Linux 4.4.69 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-05-20Bluetooth: Fix user channel for 32bit userspace on 64bit kernelSzymon Janc
commit ab89f0bdd63a3721f7cd3f064f39fc4ac7ca14d4 upstream. Running 32bit userspace on 64bit kernel results in MSG_CMSG_COMPAT being defined as 0x80000000. This results in sendmsg failure if used from 32bit userspace running on 64bit kernel. Fix this by accounting for MSG_CMSG_COMPAT in flags check in hci_sock_sendmsg. Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl> Signed-off-by: Marko Kiiskila <marko@runtime.io> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-08-22Merge tag 'v4.4.19' into android-4.4.yDmitry Shmidt
This is the 4.4.19 stable release
2016-08-20Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTUAmadeusz Sławiński
commit 23bc6ab0a0912146fd674a0becc758c3162baabc upstream. When we retrieve imtu value from userspace we should use 16 bit pointer cast instead of 32 as it's defined that way in headers. Fixes setsockopt calls on big-endian platforms. Signed-off-by: Amadeusz Sławiński <amadeusz.slawinski@tieto.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-08-01Merge tag 'v4.4.16' into android-4.4.yDmitry Shmidt
This is the 4.4.16 stable release Change-Id: Ibaf7b7e03695e1acebc654a2ca1a4bfcc48fcea4
2016-04-12Bluetooth: Fix potential buffer overflow with Add AdvertisingJohan Hedberg
commit 6a0e78072c2ae7b20b14e0249d8108441ea928d2 upstream. The Add Advertising command handler does the appropriate checks for the AD and Scan Response data, however fails to take into account the general length of the mgmt command itself, which could lead to potential buffer overflows. This patch adds the necessary check that the mgmt command length is consistent with the given ad and scan_rsp lengths. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packetsLukasz Duda
commit 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 upstream. This patch fixes incorrect handling of the 6lowpan packets that contain uncompressed IPv6 header. RFC4944 specifies a special dispatch for 6lowpan to carry uncompressed IPv6 header. This dispatch (1 byte long) has to be removed during reception and skb data pointer has to be moved. To correctly point in the beginning of the IPv6 header the dispatch byte has to be pulled off before packet can be processed by netif_rx_in(). Test scenario: IPv6 packets are not correctly interpreted by the network layer when IPv6 header is not compressed (e.g. ICMPv6 Echo Reply is not propagated correctly to the ICMPv6 layer because the extra byte will make the header look corrupted). Similar approach is done for IEEE 802.15.4. Signed-off-by: Lukasz Duda <lukasz.duda@nordicsemi.no> Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no> Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03Bluetooth: 6lowpan: Fix kernel NULL pointer dereferencesGlenn Ruben Bakke
commit 4c58f3282e3de43d34f8955f8eca676294380bf9 upstream. The fixes provided in this patch assigns a valid net_device structure to skb before dispatching it for further processing. Scenario #1: ============ Bluetooth 6lowpan receives an uncompressed IPv6 header, and dispatches it to netif. The following error occurs: Null pointer dereference error #1 crash log: [ 845.854013] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 845.855785] IP: [<ffffffff816e3d36>] enqueue_to_backlog+0x56/0x240 ... [ 845.909459] Call Trace: [ 845.911678] [<ffffffff816e3f64>] netif_rx_internal+0x44/0xf0 The first modification fixes the NULL pointer dereference error by assigning dev to the local_skb in order to set a valid net_device before processing the skb by netif_rx_ni(). Scenario #2: ============ Bluetooth 6lowpan receives an UDP compressed message which needs further decompression by nhc_udp. The following error occurs: Null pointer dereference error #2 crash log: [ 63.295149] BUG: unable to handle kernel NULL pointer dereference at 0000000000000840 [ 63.295931] IP: [<ffffffffc0559540>] udp_uncompress+0x320/0x626 [nhc_udp] The second modification fixes the NULL pointer dereference error by assigning dev to the local_skb in the case of a udp compressed packet. The 6lowpan udp_uncompress function expects that the net_device is set in the skb when checking lltype. Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no> Signed-off-by: Lukasz Duda <lukasz.duda@nordicsemi.no> Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03Bluetooth: Fix incorrect removing of IRKsJohan Hedberg
commit cff10ce7b4f02718ffd25e3914e60559f5ef6ca0 upstream. The commit cad20c278085d893ebd616cd20c0747a8e9d53c7 was supposed to fix handling of devices first using public addresses and then switching to RPAs after pairing. Unfortunately it missed a couple of key places in the code. 1. When evaluating which devices should be removed from the existing white list we also need to consider whether we have an IRK for them or not, i.e. a call to hci_find_irk_by_addr() is needed. 2. In smp_notify_keys() we should not be requiring the knowledge of the RPA, but should simply keep the IRK around if the other conditions require it. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03Bluetooth: Use continuous scanning when creating LE connectionsJohan Hedberg
commit 2f99536a5b34d5b0f54723067d68f6cef3f0fdc6 upstream. All LE connections are now triggered through a preceding passive scan and waiting for a connectable advertising report. This means we've got the best possible guarantee that the device is within range and should be able to request the controller to perform continuous scanning. This way we minimize the risk that we miss out on any advertising packets. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-16Paranoid network.Robert Love
With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate network sockets. Signed-off-by: Robert Love <rlove@google.com> paranoid networking: Use in_egroup_p() to check group membership The previous group_search() caused trouble for partners with module builds. in_egroup_p() is also cleaner. Signed-off-by: Nick Pelly <npelly@google.com> Fix 2.6.29 build. Signed-off-by: Arve Hjønnevåg <arve@android.com> net: Fix compilation of the IPv6 module Fix compilation of the IPv6 module -- current->euid does not exist anymore, current_euid() is what needs to be used. Signed-off-by: Steinar H. Gunderson <sesse@google.com> net: bluetooth: Remove the AID_NET_BT* gid numbers Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN which are not useful anymore. This is in preparation for getting rid of all the AID_* gids. Signed-off-by: JP Abgrall <jpa@google.com>
2015-12-15bluetooth: Validate socket address length in sco_sock_bind().David S. Miller
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-03Merge branch 'for-upstream' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2015-12-01 Here's a Bluetooth fix for the 4.4-rc series that fixes a memory leak of the Security Manager L2CAP channel that'll happen for every LE connection. Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-01net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATAEric Dumazet
This patch is a cleanup to make following patch easier to review. Goal is to move SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA from (struct socket)->flags to a (struct socket_wq)->flags to benefit from RCU protection in sock_wake_async() To ease backports, we rename both constants. Two new helpers, sk_set_bit(int nr, struct sock *sk) and sk_clear_bit(int net, struct sock *sk) are added so that following patch can change their implementation. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-11Bluetooth: Fix l2cap_chan leak in SMPJohan Hedberg
The L2CAP core expects channel implementations to manage the reference returned by the new_connection callback. With sockets this is already handled with each channel being tied to the corresponding socket. With SMP however there's no context to tie the pointer to in the smp_new_conn_cb function. The function can also not just drop the reference since it's the only one at that point. For fixed channels (like SMP) the code path inside the L2CAP core from new_connection() to ready() is short and straight-forwards. The crucial difference is that in ready() the implementation has access to the l2cap_conn that SMP needs associate its l2cap_chan. Instead of taking a new reference in smp_ready_cb() we can simply assume to already own the reference created in smp_new_conn_cb(), i.e. there is no need to call l2cap_chan_hold(). Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: stable@vger.kernel.org # 3.19+
2015-11-05Bluetooth: L2CAP: Add missing checks for invalid LE DCIDJohan Hedberg
When receiving a connect response we should make sure that the DCID is within the valid range and that we don't already have another channel allocated for the same DCID. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-11-05Bluetooth: L2CAP: Fix checked range when allocating new CIDJohan Hedberg
The 'dyn_end' value is also a valid CID so it should be included in the range of values checked. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-11-05Bluetooth: L2CAP: Fix returning correct LE CoC response codesJohan Hedberg
The core spec defines specific response codes for situations when the received CID is incorrect. Add the defines for these and return them as appropriate from the LE Connect Request handler function. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-11-05Bluetooth: Check for supported white list before issuing commandsMarcel Holtmann
The white list commands might not be implemented if the controller does not actually support the white list. So check the supported commands first before issuing these commands. Not supporting the white list is the same as supporting a white list with zero size. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-27bluetooth: 6lowpan: fix NOHZ: local_softirq_pendingAlexander Aring
Jukka reported about the following warning: "NOHZ: local_softirq_pending 08" I remember this warning and we had a similar issue when using workqueues and calling netif_rx. See commit 5ff3fec ("mac802154: fix NOHZ local_softirq_pending 08 warning"). This warning occurs when calling "netif_rx" inside the wrong context (non softirq context). The net core api offers "netif_rx_ni" to call netif_rx inside the correct softirq context. Reported-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Alexander Aring <alex.aring@gmail.com> Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-27Bluetooth: Fix crash on fast disconnect of SCOKuba Pawlak
Fix a crash that may happen when a connection is closed before it was fully established. Mapping conn->hcon was released by shutdown function, but it is still referenced in (not yet finished) connection established handling function. [ 4635.254073] BUG: unable to handle kernel NULL pointer dereference at 00000013 [ 4635.262058] IP: [<c11659f0>] memcmp+0xe/0x25 [ 4635.266835] *pdpt = 0000000024190001 *pde = 0000000000000000 [ 4635.273261] Oops: 0000 [#1] PREEMPT SMP [ 4635.277652] Modules linked in: evdev ecb vfat fat libcomposite usb2380 isofs zlib_inflate rfcomm(O) udc_core bnep(O) btusb(O) btbcm(O) btintel(O) bluetooth(O) cdc_acm arc4 uinput hid_mule [ 4635.321761] Pid: 363, comm: kworker/u:2H Tainted: G O 3.8.0-119.1-plk-adaptation-byt-ivi-brd #1 [ 4635.332642] EIP: 0060:[<c11659f0>] EFLAGS: 00010206 CPU: 0 [ 4635.338767] EIP is at memcmp+0xe/0x25 [ 4635.342852] EAX: e4720678 EBX: 00000000 ECX: 00000006 EDX: 00000013 [ 4635.349849] ESI: 00000000 EDI: fb85366c EBP: e40c7dc0 ESP: e40c7db4 [ 4635.356846] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 4635.362873] CR0: 8005003b CR2: 00000013 CR3: 24191000 CR4: 001007f0 [ 4635.369869] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 4635.376865] DR6: ffff0ff0 DR7: 00000400 [ 4635.381143] Process kworker/u:2H (pid: 363, ti=e40c6000 task=e40c5510 task.ti=e40c6000) [ 4635.390080] Stack: [ 4635.392319] e4720400 00000000 fb85366c e40c7df4 fb842285 e40c7de2 fb853200 00000013 [ 4635.401003] e3f101c4 e4720678 e3f101c0 e403be0a e40c7dfc e416a000 e403be0a fb85366c [ 4635.409692] e40c7e1c fb820186 020f6c00 e47c49ac e47c4008 00000000 e416a000 e47c402c [ 4635.418380] Call Trace: [ 4635.421153] [<fb842285>] sco_connect_cfm+0xff/0x236 [bluetooth] [ 4635.427893] [<fb820186>] hci_sync_conn_complete_evt.clone.101+0x227/0x268 [bluetooth] [ 4635.436758] [<fb82370f>] hci_event_packet+0x1caa/0x21d3 [bluetooth] [ 4635.443859] [<c106231f>] ? trace_hardirqs_on+0xb/0xd [ 4635.449502] [<c1375b8a>] ? _raw_spin_unlock_irqrestore+0x42/0x59 [ 4635.456340] [<fb814b67>] hci_rx_work+0xb9/0x350 [bluetooth] [ 4635.462663] [<c1039f1e>] ? process_one_work+0x17b/0x2e6 [ 4635.468596] [<c1039f77>] process_one_work+0x1d4/0x2e6 [ 4635.474333] [<c1039f1e>] ? process_one_work+0x17b/0x2e6 [ 4635.480294] [<fb814aae>] ? hci_cmd_work+0xda/0xda [bluetooth] [ 4635.486810] [<c103a3fa>] worker_thread+0x171/0x20f [ 4635.492257] [<c10456c5>] ? complete+0x34/0x3e [ 4635.497219] [<c103ea06>] kthread+0x90/0x95 [ 4635.501888] [<c103a289>] ? manage_workers+0x1df/0x1df [ 4635.507628] [<c1376537>] ret_from_kernel_thread+0x1b/0x28 [ 4635.513755] [<c103e976>] ? __init_kthread_worker+0x42/0x42 [ 4635.519975] Code: 74 0d 3c 79 74 04 3c 59 75 0c c6 02 01 eb 03 c6 02 00 31 c0 eb 05 b8 ea ff ff ff 5d c3 55 89 e5 57 56 53 31 db eb 0e 0f b6 34 18 <0f> b6 3c 1a 43 29 fe 75 07 49 85 c9 7f [ 4635.541264] EIP: [<c11659f0>] memcmp+0xe/0x25 SS:ESP 0068:e40c7db4 [ 4635.548166] CR2: 0000000000000013 [ 4635.552177] ---[ end trace e05ce9b8ce6182f6 ]--- Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-26Bluetooth: Fix some obvious coding style issues in the SCO moduleMarcel Holtmann
Lets fix this obvious coding style issues in the SCO module and bring it in line with the rest of the Bluetooth subsystem. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-26Bluetooth: Replace hci_notify with hci_sock_dev_eventMarcel Holtmann
There is no point in wrapping hci_sock_dev_event around hci_notify. It is an empty wrapper which adds no value. So remove it. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-26Bluetooth: Rename bt_cb()->req into bt_cb()->hciMarcel Holtmann
The SKB context buffer for HCI request is really not just for requests, information in their are preserved for the whole HCI layer. So it makes more sense to actually rename it into bt_cb()->hci and also call it then struct hci_ctrl. In addition that allows moving the decoded opcode for outgoing packets into that struct. So far it was just consuming valuable space from the main shared items. And opcode are not valid for L2CAP packets. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-26Bluetooth: Remove unneeded parenthesis around MSG_OOBMarcel Holtmann
There are two checks that are still using (MSG_OOB) instead of just MSG_OOB and so lets just fix them. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-25Bluetooth: Fix locking issue during fast SCO reconnection.Kuba Pawlak
When SCO connection is requested and disconnected fast, there is a change that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm. When this happens struct sock sk may be removed but a pointer to it is still held in sco_conn_ready, where embedded spinlock is used. If it is used, but struct sock has been removed, it will crash. Block connection object, which will prevent struct sock from being removed and give connection process chance to finish. BUG: spinlock bad magic on CPU#0, kworker/u:2H/319 lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160 Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1 Call Trace: [<c1155659>] ? do_raw_spin_lock+0x19/0xe9 [<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth] [<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth] [<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth] [<c1041095>] ? finish_task_switch+0x50/0x89 [<c1349a2e>] ? __schedule+0x638/0x6b8 [<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth] [<c103760a>] ? queue_delayed_work_on+0x21/0x2a [<c1035df9>] ? process_one_work+0x157/0x21b [<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth] [<c1036217>] ? worker_thread+0x16e/0x20a [<c10360a9>] ? manage_workers+0x1cf/0x1cf [<c103a0ef>] ? kthread+0x8d/0x92 [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28 [<c103a062>] ? __init_kthread_worker+0x24/0x24 BUG: unable to handle kernel NULL pointer dereference at (null) IP: [< (null)>] (null) *pdpt = 00000000244e1001 *pde = 0000000000000000 Oops: 0010 [#1] PREEMPT SMP Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1 EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0 EIP is at 0x0 EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000 ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000) Stack: fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7 Call Trace: [<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth] [<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth] [<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth] [<c1041095>] ? finish_task_switch+0x50/0x89 [<c1349a2e>] ? __schedule+0x638/0x6b8 [<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth] [<c103760a>] ? queue_delayed_work_on+0x21/0x2a [<c1035df9>] ? process_one_work+0x157/0x21b [<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth] [<c1036217>] ? worker_thread+0x16e/0x20a [<c10360a9>] ? manage_workers+0x1cf/0x1cf [<c103a0ef>] ? kthread+0x8d/0x92 [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28 [<c103a062>] ? __init_kthread_worker+0x24/0x24 Code: Bad EIP value. EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14 CR2: 0000000000000000 ---[ end trace 942a6577c0abd725 ]--- Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25Bluetooth: Fix locking issue on SCO disconnectionKuba Pawlak
Thread handling SCO disconnection may get preempted in '__sco_sock_close' after dropping a reference to hci_conn but before marking this as NULL in associated struct sco_conn. When execution returs to this thread, this connection will possibly be released, resulting in kernel crash Lock connection before this point. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<fb770ab9>] __sco_sock_close+0x194/0x1ff [bluetooth] *pdpt = 0000000023da6001 *pde = 0000000000000000 Oops: 0002 [#1] PREEMPT SMP Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid iwlmvm(O) hide Pid: 984, comm: bluetooth Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1 EIP: 0060:[<fb770ab9>] EFLAGS: 00010282 CPU: 2 EIP is at __sco_sock_close+0x194/0x1ff [bluetooth] EAX: 00000000 EBX: e49d7600 ECX: ef1ec3c2 EDX: 000000c3 ESI: e4c12000 EDI: 00000000 EBP: ef1edf5c ESP: ef1edf4c DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 CR0: 80050033 CR2: 00000000 CR3: 23da7000 CR4: 001007f0 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 Process bluetooth (pid: 984, ti=ef1ec000 task=e47f2550 task.ti=ef1ec000) Stack: e4c120d0 e49d7600 00000000 08421a40 ef1edf70 fb770b7a 00000002 e8a4cc80 08421a40 ef1ec000 c12966b1 00000001 00000000 0000000b 084954c8 c1296b6c 0000001b 00000002 0000001b 00000002 00000000 00000002 b2524880 00000046 Call Trace: [<fb770b7a>] ? sco_sock_shutdown+0x56/0x95 [bluetooth] [<c12966b1>] ? sys_shutdown+0x37/0x53 [<c1296b6c>] ? sys_socketcall+0x12e/0x1be [<c134ae7e>] ? sysenter_do_call+0x12/0x26 [<c1340000>] ? ip_vs_control_net_cleanup+0x46/0xb1 Code: e8 90 6b 8c c5 f6 05 72 5d 78 fb 04 74 17 8b 46 08 50 56 68 0a fd 77 fb 68 60 5d 78 fb e8 68 95 9e c5 83 c4 10 8b 83 fc 01 00 00 <c7> 00 00 00 00 00 eb 32 ba 68 00 00 0b EIP: [<fb770ab9>] __sco_sock_close+0x194/0x1ff [bluetooth] SS:ESP 0068:ef1edf4c CR2: 0000000000000000 ---[ end trace 47fa2f55a9544e69 ]--- Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-25Bluetooth: Fix crash on SCO disconnectKuba Pawlak
When disconnecting audio from the phone's side, it may happen, that a thread handling HCI message 'disconnection complete' will get preempted in 'sco_conn_del' before calling 'sco_sock_kill', still holding a pointer to struct sock sk. Interrupting thread started in 'sco_sock_shutdown' will carry on releasing resources and will eventually release struct sock. When execution goes back to first thread it will call sco_sock_kill using now invalid pointer to already destroyed socket. Fix is to grab a reference to the socket a release it after calling 'sco_sock_kill'. [ 166.358213] BUG: unable to handle kernel paging request at 7541203a [ 166.365228] IP: [<fb6e8bfb>] bt_sock_unlink+0x1a/0x38 [bluetooth] [ 166.372068] *pdpt = 0000000024b19001 *pde = 0000000000000000 [ 166.378483] Oops: 0002 [#1] PREEMPT SMP [ 166.382871] Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) btintel(O) cdc_acm bluetooth(O) arc4 uinput hid_multitouch iwlmvm(O) usbhid hide [ 166.424233] Pid: 338, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1 [ 166.435112] EIP: 0060:[<fb6e8bfb>] EFLAGS: 00010206 CPU: 0 [ 166.441259] EIP is at bt_sock_unlink+0x1a/0x38 [bluetooth] [ 166.447382] EAX: 632e6563 EBX: e4bfc600 ECX: e466d4d3 EDX: 7541203a [ 166.454369] ESI: fb7278ac EDI: e4d52000 EBP: e4669e20 ESP: e4669e0c [ 166.461366] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 166.467391] CR0: 8005003b CR2: 7541203a CR3: 24aba000 CR4: 001007f0 [ 166.474387] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 166.481375] DR6: ffff0ff0 DR7: 00000400 [ 166.485654] Process kworker/u:2H (pid: 338, ti=e4668000 task=e466e030 task.ti=e4668000) [ 166.494591] Stack: [ 166.496830] e4bfc600 e4bfc600 fb715c28 e4717ee0 e4d52000 e4669e3c fb715cf3 e4bfc634 [ 166.505518] 00000068 e4d52000 e4c32000 fb7277c0 e4669e6c fb6f2019 0000004a 00000216 [ 166.514205] e4660101 e4c32008 02000001 00000013 e4d52000 e4c32000 e3dc9240 00000005 [ 166.522891] Call Trace: [ 166.525654] [<fb715c28>] ? sco_sock_kill+0x73/0x9a [bluetooth] [ 166.532295] [<fb715cf3>] ? sco_conn_del+0xa4/0xbf [bluetooth] [ 166.538836] [<fb6f2019>] ? hci_disconn_complete_evt.clone.55+0x1bd/0x205 [bluetooth] [ 166.547609] [<fb6f73d3>] ? hci_event_packet+0x297/0x223c [bluetooth] [ 166.554805] [<c10416da>] ? dequeue_task+0xaf/0xb7 [ 166.560154] [<c1041095>] ? finish_task_switch+0x50/0x89 [ 166.566086] [<c1349a2e>] ? __schedule+0x638/0x6b8 [ 166.571460] [<fb6eb906>] ? hci_rx_work+0xb9/0x2b8 [bluetooth] [ 166.577975] [<c1035df9>] ? process_one_work+0x157/0x21b [ 166.583933] [<fb6eb84d>] ? hci_cmd_work+0xef/0xef [bluetooth] [ 166.590448] [<c1036217>] ? worker_thread+0x16e/0x20a [ 166.596088] [<c10360a9>] ? manage_workers+0x1cf/0x1cf [ 166.601826] [<c103a0ef>] ? kthread+0x8d/0x92 [ 166.606691] [<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28 [ 166.613010] [<c103a062>] ? __init_kthread_worker+0x24/0x24 [ 166.619230] Code: 85 63 ff ff ff 31 db 8d 65 f4 89 d8 5b 5e 5f 5d c3 56 8d 70 04 53 89 f0 89 d3 e8 7e 17 c6 c5 8b 53 28 85 d2 74 1a 8b 43 24 85 c0 <89> 02 74 03 89 50 04 c7 43 28 00 00 00 [ 166.640501] EIP: [<fb6e8bfb>] bt_sock_unlink+0x1a/0x38 [bluetooth] SS:ESP 0068:e4669e0c [ 166.649474] CR2: 000000007541203a [ 166.653420] ---[ end trace 0181ff2c9e42d51e ]--- [ 166.658609] note: kworker/u:2H[338] exited with preempt_count 1 Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-22Bluetooth: Increase minor version of core moduleMarcel Holtmann
With the addition of support for diagnostic feature, it makes sense to increase the minor version of the Bluetooth core module. The module version is not used anywhere, but it gives a nice extra hint for debugging purposes. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-10-22Bluetooth: Make hci_disconnect() behave correctly for all statesJohan Hedberg
There are a few places that don't explicitly check the connection state before calling hci_disconnect(). To make this API do the right thing take advantage of the new hci_abort_conn() API and also make sure to only read the clock offset if we're really connected. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-22Bluetooth: Take advantage of connection abort helpersJohan Hedberg
Convert the various places mapping connection state to disconnect/cancel HCI command to use the new hci_abort_conn helper API. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-22Bluetooth: Introduce hci_req helper to abort a connectionJohan Hedberg
There are several different places needing to make sure that a connection gets disconnected or canceled. The exact action needed depends on the connection state, so centralizing this logic can save quite a lot of code duplication. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-22Bluetooth: Fix crash in SMP when unpairingJohan Hedberg
When unpairing the keys stored in hci_dev are removed. If SMP is ongoing the SMP context will also have references to these keys, so removing them from the hci_dev lists will make the pointers invalid. This can result in the following type of crashes: BUG: unable to handle kernel paging request at 6b6b6b6b IP: [<c11f26be>] __list_del_entry+0x44/0x71 *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC Modules linked in: hci_uart btqca btusb btintel btbcm btrtl hci_vhci rfcomm bluetooth_6lowpan bluetooth CPU: 0 PID: 723 Comm: kworker/u5:0 Not tainted 4.3.0-rc3+ #1379 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 Workqueue: hci0 hci_rx_work [bluetooth] task: f19da940 ti: f1a94000 task.ti: f1a94000 EIP: 0060:[<c11f26be>] EFLAGS: 00010202 CPU: 0 EIP is at __list_del_entry+0x44/0x71 EAX: c0088d20 EBX: f30fcac0 ECX: 6b6b6b6b EDX: 6b6b6b6b ESI: f4b60000 EDI: c0088d20 EBP: f1a95d90 ESP: f1a95d8c DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 8005003b CR2: 6b6b6b6b CR3: 319e5000 CR4: 00000690 Stack: f30fcac0 f1a95db0 f82dc3e1 f1bfc000 00000000 c106524f f1bfc000 f30fd020 f1a95dc0 f1a95dd0 f82dcbdb f1a95de0 f82dcbdb 00000067 f1bfc000 f30fd020 f1a95de0 f1a95df0 f82d1126 00000067 f82d1126 00000006 f30fd020 f1bfc000 Call Trace: [<f82dc3e1>] smp_chan_destroy+0x192/0x240 [bluetooth] [<c106524f>] ? trace_hardirqs_on_caller+0x14e/0x169 [<f82dcbdb>] smp_teardown_cb+0x47/0x64 [bluetooth] [<f82dcbdb>] ? smp_teardown_cb+0x47/0x64 [bluetooth] [<f82d1126>] l2cap_chan_del+0x5d/0x14d [bluetooth] [<f82d1126>] ? l2cap_chan_del+0x5d/0x14d [bluetooth] [<f82d40ef>] l2cap_conn_del+0x109/0x17b [bluetooth] [<f82d40ef>] ? l2cap_conn_del+0x109/0x17b [bluetooth] [<f82c0205>] ? hci_event_packet+0x5b1/0x2092 [bluetooth] [<f82d41aa>] l2cap_disconn_cfm+0x49/0x50 [bluetooth] [<f82d41aa>] ? l2cap_disconn_cfm+0x49/0x50 [bluetooth] [<f82c0228>] hci_event_packet+0x5d4/0x2092 [bluetooth] [<c1332c16>] ? skb_release_data+0x6a/0x95 [<f82ce5d4>] ? hci_send_to_monitor+0xe7/0xf4 [bluetooth] [<c1409708>] ? _raw_spin_unlock_irqrestore+0x44/0x57 [<f82b3bb0>] hci_rx_work+0xf1/0x28b [bluetooth] [<f82b3bb0>] ? hci_rx_work+0xf1/0x28b [bluetooth] [<c10635a0>] ? __lock_is_held+0x2e/0x44 [<c104772e>] process_one_work+0x232/0x432 [<c1071ddc>] ? rcu_read_lock_sched_held+0x50/0x5a [<c104772e>] ? process_one_work+0x232/0x432 [<c1047d48>] worker_thread+0x1b8/0x255 [<c1047b90>] ? rescuer_thread+0x23c/0x23c [<c104bb71>] kthread+0x91/0x96 [<c14096a7>] ? _raw_spin_unlock_irq+0x27/0x44 [<c1409d61>] ret_from_kernel_thread+0x21/0x30 [<c104bae0>] ? kthread_parkme+0x1e/0x1e To solve the issue, introduce a new smp_cancel_pairing() API that can be used to clean up the SMP state before touching the hci_dev lists. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-22Bluetooth: Disable auto-connection parameters when unpairingJohan Hedberg
For connection parameters that are left around until a disconnection we should at least clear any auto-connection properties. This way a new Add Device call is required to re-set them after calling Unpair Device. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-21Bluetooth: Remove unnecessary hci_explicit_connect_lookup functionJohan Hedberg
There's only one user of this helper which can be replaces with a call to hci_pend_le_action_lookup() and a check for params->explicit_connect. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-21Bluetooth: Remove redundant (and possibly wrong) flag clearingJohan Hedberg
There's no need to clear the HCI_CONN_ENCRYPT_PEND flag in smp_failure. In fact, this may cause the encryption tracking to get out of sync as this has nothing to do with HCI activity. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-18 02:18:22 +0000