1. 25 Jul, 2013 8 commits
    • AceLan Kao's avatar
      Bluetooth: Add support for Atheros [0cf3:e003] · 1d5b569e
      AceLan Kao authored
      Add support for the AR9462 chip
      
      T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0cf3 ProdID=e003 Rev=00.02
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      
      Cc: Stable <stable@vger.kernel.org>
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      1d5b569e
    • Gustavo Padovan's avatar
      Bluetooth: Fix race between hci_register_dev() and hci_dev_open() · fcee3377
      Gustavo Padovan authored
      If hci_dev_open() is called after hci_register_dev() added the device to
      the hci_dev_list but before the workqueue are created we could run into a
      NULL pointer dereference (see below).
      
      This bug is very unlikely to happen, systems using bluetoothd to
      manage their bluetooth devices will never see this happen.
      
      BUG: unable to handle kernel NULL pointer dereference
      0100
      IP: [<ffffffff81077502>] __queue_work+0x32/0x3d0
      (...)
      Call Trace:
       [<ffffffff81077be5>] queue_work_on+0x45/0x50
       [<ffffffffa016e8ff>] hci_req_run+0xbf/0xf0 [bluetooth]
       [<ffffffffa01709b0>] ? hci_init2_req+0x720/0x720 [bluetooth]
       [<ffffffffa016ea06>] __hci_req_sync+0xd6/0x1c0 [bluetooth]
       [<ffffffff8108ee10>] ? try_to_wake_up+0x2b0/0x2b0
       [<ffffffff8150e3f0>] ? usb_autopm_put_interface+0x30/0x40
       [<ffffffffa016fad5>] hci_dev_open+0x275/0x2e0 [bluetooth]
       [<ffffffffa0182752>] hci_sock_ioctl+0x1f2/0x3f0 [bluetooth]
       [<ffffffff815c6050>] sock_do_ioctl+0x30/0x70
       [<ffffffff815c75f9>] sock_ioctl+0x79/0x2f0
       [<ffffffff811a8046>] do_vfs_ioctl+0x96/0x560
       [<ffffffff811a85a1>] SyS_ioctl+0x91/0xb0
       [<ffffffff816d989d>] system_call_fastpath+0x1a/0x1f
      Reported-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      fcee3377
    • AceLan Kao's avatar
      Bluetooth: Add support for Atheros [0cf3:3121] · 1ebd0b21
      AceLan Kao authored
      Add support for the AR3012 chip.
      
      T:  Bus=03 Lev=01 Prnt=01 Port=06 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0cf3 ProdID=3121 Rev=00.02
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      1ebd0b21
    • Sujith Manoharan's avatar
      Bluetooth: ath3k: Add support for ID 0x13d3/0x3402 · 5b77a1f3
      Sujith Manoharan authored
      T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=13d3 ProdID=3402 Rev= 0.02
      S:  Manufacturer=Atheros Communications
      S:  Product=Bluetooth USB Host Controller
      S:  SerialNumber=Alaska Day 2006
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      
      Bug: https://bugzilla.kernel.org/show_bug.cgi?id=59701Signed-off-by: default avatarSujith Manoharan <sujith@msujith.org>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      5b77a1f3
    • Adam Lee's avatar
      Bluetooth: fix wrong use of PTR_ERR() in btusb · d9c78e97
      Adam Lee authored
      PTR_ERR() returns a signed long type value which is limited by IS_ERR(),
      it must be a negative number whose range is [-MAX_ERRNO, 0).
      
      The bug here returns negative numbers as error codes, then check it by
      "if (ret < 0)", but -PTR_ERR() is actually positive. The wrong use here
      leads to failure as below, even panic.
      
      [   12.958920] Bluetooth: hci0 command 0xfc8e tx timeout
      [   14.961765] Bluetooth: hci0 command 0xfc8e tx timeout
      [   16.964688] Bluetooth: hci0 command 0xfc8e tx timeout
      [   20.954501] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   22.957358] Bluetooth: hci0 command 0xfc8e tx timeout
      [   30.948922] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   32.951780] Bluetooth: hci0 command 0xfc8e tx timeout
      [   40.943359] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   42.946219] Bluetooth: hci0 command 0xfc8e tx timeout
      [   50.937812] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   52.940670] Bluetooth: hci0 command 0xfc8e tx timeout
      [   60.932236] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   62.935092] Bluetooth: hci0 command 0xfc8e tx timeout
      [   70.926688] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   72.929545] Bluetooth: hci0 command 0xfc8e tx timeout
      [   80.921111] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110)
      [   82.923969] Bluetooth: hci0 command 0xfc2f tx timeout
      [   90.915542] Bluetooth: hci0 sending Intel patch command (0xfc2f) failed (-110)
      [   92.918406] Bluetooth: hci0 command 0xfc11 tx timeout
      [  100.909955] Bluetooth: hci0 sending Intel patch command (0xfc11) failed (-110)
      [  102.912858] Bluetooth: hci0 command 0xfc60 tx timeout
      [  110.904394] Bluetooth: hci0 sending Intel patch command (0xfc60) failed (-110)
      [  112.907293] Bluetooth: hci0 command 0xfc11 tx timeout
      [  120.898831] Bluetooth: hci0 exiting Intel manufacturer mode failed (-110)
      [  120.904757] bluetoothd[1030]: segfault at 4 ip 00007f8b2eb55236 sp 00007fff53ff6920 error 4 in bluetoothd[7f8b2eaff000+cb000]
      Signed-off-by: default avatarAdam Lee <adam.lee@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      d9c78e97
    • Stanislaw Gruszka's avatar
      Bluetooth: ath3k: don't use stack memory for DMA · 517828a8
      Stanislaw Gruszka authored
      Memory allocated by vmalloc (including stack) can not be used for DMA,
      i.e. data pointer on usb_control_msg() should not point to stack memory.
      
      Resolves:
      https://bugzilla.redhat.com/show_bug.cgi?id=977558Reported-and-tested-by: default avatarAndy Lawrence <dr.diesel@gmail.com>
      Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      517828a8
    • Thomas Loo's avatar
      Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330] · 84eb2ae1
      Thomas Loo authored
      The Fujitsu Lifebook UH552/UH572 ships with a Qualcomm AR9462/AR3012
      WLAN/BT-Combo card.
      Add device ID to the ath3k driver to enable the bluetooth side of things.
      Patch against v3.10.
      
      T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04c5 ProdID=1330 Rev=00.02
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarThomas Loo <tloo@saltstorm.net>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      84eb2ae1
    • Jaganath Kanakkassery's avatar
      Bluetooth: Fix invalid length check in l2cap_information_rsp() · da9910ac
      Jaganath Kanakkassery authored
      The length check is invalid since the length varies with type of
      info response.
      
      This was introduced by the commit cb3b3152
      
      Because of this, l2cap info rsp is not handled and command reject is sent.
      
      > ACL data: handle 11 flags 0x02 dlen 16
              L2CAP(s): Info rsp: type 2 result 0
                Extended feature mask 0x00b8
                  Enhanced Retransmission mode
                  Streaming mode
                  FCS Option
                  Fixed Channels
      < ACL data: handle 11 flags 0x00 dlen 10
              L2CAP(s): Command rej: reason 0
                Command not understood
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJaganath Kanakkassery <jaganath.k@samsung.com>
      Signed-off-by: default avatarChan-Yeol Park <chanyeol.park@samsung.com>
      Acked-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      da9910ac
  2. 24 Jun, 2013 2 commits
  3. 19 Jun, 2013 2 commits
  4. 13 Jun, 2013 4 commits
    • Arend van Spriel's avatar
      brcmfmac: free primary net_device when brcmf_bus_start() fails · fcb37018
      Arend van Spriel authored
      When initialization within brcmf_bus_start() fails on steps
      before the brcmf_net_attach() the net_device for the primary
      interface needs to be freed.
      
      This patch resolves a panic during kernel boot as reported
      by Stephen Warren.
      
      ref.: http://mid.gmane.org/51AD1F22.2080004@wwwdotorg.orgTested-by: default avatarStephen Warren <swarren@nvidia.com>
      Reviewed-by: default avatarHante Meuleman <meuleman@broadcom.com>
      Reviewed-by: default avatarPieter-Paul Giesberts <pieterpg@broadcom.com>
      Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      fcb37018
    • Daniel Drake's avatar
      Bluetooth: btmrvl: fix thread stopping race · ea05fea9
      Daniel Drake authored
      There is currently a race condition in the btmrvl_remove_card() which
      is causing hangs on suspend for OLPC. When the race occurs,
      kthread_stop() never returns.
      
      The problem is that btmrvl_service_main_thread() calls kthread_should_stop()
      and then does a fair number of things before restarting the loop and
      sleeping.
      
      If the thread gets stopped after kthread_should_stop() is checked, but
      before the sleep happens, the thread will go to sleep and won't necessarily
      be woken up.
      
      Move the kthread_should_stop() check into a race-free place.
      Signed-off-by: default avatarDaniel Drake <dsd@laptop.org>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      ea05fea9
    • Johan Hedberg's avatar
      Bluetooth: Fix conditions for HCI_Delete_Stored_Link_Key · 59f45d57
      Johan Hedberg authored
      Even though the HCI_Delete_Stored_Link_Key command is mandatory for 1.1
      and later controllers some controllers do not seem to support it
      properly as was witnessed by one Broadcom based controller:
      
      < HCI Command: Delete Stored Link Key (0x03|0x0012) plen 7
          bdaddr 00:00:00:00:00:00 all 1
      > HCI Event: Command Complete (0x0e) plen 4
          Delete Stored Link Key (0x03|0x0012) ncmd 1
          status 0x11 deleted 0
          Error: Unsupported Feature or Parameter Value
      
      Luckily this same controller also doesn't list the command in its
      supported commands bit mask (counting from 0 bit 7 of octet 6):
      
      < HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0
      > HCI Event: Command Complete (0x0e) plen 68
          Read Local Supported Commands (0x04|0x0002) ncmd 1
          status 0x00
          Commands: ffffffffffff1ffffffffffff30fffff3f
      
      Therefore, it makes sense to move sending of HCI_Delete_Stored_Link_Key
      to after receiving the supported commands response and to only send it
      if its respective bit in the mask is set. The downside of this is that
      we no longer send the HCI_Delete_Stored_Link_Key command for Bluetooth
      1.1 controllers since HCI_Read_Local_Supported_Command was introduced in
      version 1.2, but this is an acceptable penalty as the command in
      question shouldn't affect critical behavior.
      Reported-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Tested-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      59f45d57
    • Anderson Lizardo's avatar
      Bluetooth: Fix crash in l2cap_build_cmd() with small MTU · 300b962e
      Anderson Lizardo authored
      If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
      controller, memory corruption happens due to a memcpy() call with
      negative length.
      
      Fix this crash on either incoming or outgoing connections with a MTU
      smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:
      
      [   46.885433] BUG: unable to handle kernel paging request at f56ad000
      [   46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
      [   46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
      [   46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
      [   46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
      [   46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
      [   46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
      [   46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
      [   46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
      [   46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
      [   46.888037] EIP is at memcpy+0x1d/0x40
      [   46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
      [   46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
      [   46.888037]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
      [   46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
      [   46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
      [   46.888037] DR6: ffff0ff0 DR7: 00000400
      [   46.888037] Stack:
      [   46.888037]  fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
      [   46.888037]  f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
      [   46.888037]  f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
      [   46.888037] Call Trace:
      [   46.888037]  [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
      [   46.888037]  [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
      [   46.888037]  [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
      [   46.888037]  [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
      [   46.888037]  [<c01a0ff8>] ? mark_held_locks+0x68/0x110
      [   46.888037]  [<c064ad20>] ? mutex_lock_nested+0x280/0x360
      [   46.888037]  [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
      [   46.888037]  [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
      [   46.888037]  [<c064ad08>] ? mutex_lock_nested+0x268/0x360
      [   46.888037]  [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
      [   46.888037]  [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
      [   46.888037]  [<c01a0ff8>] ? mark_held_locks+0x68/0x110
      [   46.888037]  [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
      [   46.888037]  [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
      [   46.888037]  [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
      [   46.888037]  [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
      [   46.888037]  [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
      [   46.888037]  [<c0158979>] process_one_work+0x1a9/0x600
      [   46.888037]  [<c01588fb>] ? process_one_work+0x12b/0x600
      [   46.888037]  [<c015922e>] ? worker_thread+0x19e/0x320
      [   46.888037]  [<c015922e>] ? worker_thread+0x19e/0x320
      [   46.888037]  [<c0159187>] worker_thread+0xf7/0x320
      [   46.888037]  [<c0159090>] ? rescuer_thread+0x290/0x290
      [   46.888037]  [<c01602f8>] kthread+0xa8/0xb0
      [   46.888037]  [<c0656777>] ret_from_kernel_thread+0x1b/0x28
      [   46.888037]  [<c0160250>] ? flush_kthread_worker+0x120/0x120
      [   46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
      [   46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
      [   46.888037] CR2: 00000000f56ad000
      [   46.888037] ---[ end trace 0217c1f4d78714a9 ]---
      Signed-off-by: default avatarAnderson Lizardo <anderson.lizardo@openbossa.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      300b962e
  5. 12 Jun, 2013 24 commits