- 09 Oct, 2012 1 commit
-
-
Sasha Levin authored
We may currently attempt to free a channel which wasn't created due to an error in the initialization path, this would cause a NULL ptr deref. This would cause the following oops: [ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 12.919131] IP: [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919135] PGD 0 [ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 12.919193] Dumping ftrace buffer: [ 12.919242] (ftrace buffer empty) [ 12.919314] Modules linked in: [ 12.919318] CPU 1 [ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30 [ 12.919374] RIP: 0010:[<ffffffff836645c4>] [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246 [ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667 [ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010 [ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001 [ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000 [ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001 [ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000 [ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0 [ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000) [ 12.919506] Stack: [ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc [ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae [ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200 [ 12.919517] Call Trace: [ 12.919522] [<ffffffff8366c7bc>] l2cap_sock_destruct+0x3c/0x80 [ 12.919527] [<ffffffff833ae0ae>] __sk_free+0x1e/0x1f0 [ 12.919530] [<ffffffff833ae2f7>] sk_free+0x17/0x20 [ 12.919585] [<ffffffff8366ca4e>] l2cap_sock_alloc.constprop.5+0x9e/0xd0 [ 12.919591] [<ffffffff8366cb9e>] l2cap_sock_create+0x7e/0x100 [ 12.919652] [<ffffffff83a4f32a>] ? _raw_read_lock+0x6a/0x80 [ 12.919658] [<ffffffff836402c4>] ? bt_sock_create+0x74/0x110 [ 12.919660] [<ffffffff83640308>] bt_sock_create+0xb8/0x110 [ 12.919664] [<ffffffff833aa232>] __sock_create+0x282/0x3b0 [ 12.919720] [<ffffffff833aa0b0>] ? __sock_create+0x100/0x3b0 [ 12.919725] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919779] [<ffffffff833aa37f>] sock_create_kern+0x1f/0x30 [ 12.919784] [<ffffffff83675714>] rfcomm_l2sock_create+0x44/0x70 [ 12.919787] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919790] [<ffffffff836785fe>] rfcomm_run+0x4e/0x1f0 [ 12.919846] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919852] [<ffffffff81138ee3>] kthread+0xe3/0xf0 [ 12.919908] [<ffffffff8117b12e>] ? put_lock_stats.isra.14+0xe/0x40 [ 12.919914] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.919968] [<ffffffff83a5077c>] ret_from_fork+0x7c/0x90 [ 12.919973] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80 ac 3a fe 48 8d 7b 10 <f0> 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08 [ 12.920165] RIP [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.920166] RSP <ffff880066933c38> [ 12.920167] CR2: 0000000000000010 [ 12.920417] ---[ end trace 5a9114e8a158ab84 ]--- Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan reference counting"). Signed-off-by:
Sasha Levin <sasha.levin@oracle.com> Signed-off-by:
Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-
- 08 Oct, 2012 1 commit
-
-
Andrei Emeltchenko authored
There are two Flush Timeouts: one is old Flush Timeot Option which is 2 octets and the second is Flush Timeout inside EFS which is 4 octets long. Signed-off-by:
Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by:
-
- 07 Oct, 2012 6 commits
-
-
Andrei Emeltchenko authored
Maximum PDU size is defined by new BT Spec as 1492 octets. Signed-off-by:
Mat Martineau <mathewm@codeaurora.org> Signed-off-by:
-
Andrei Emeltchenko authored
Signed-off-by:
-
Andrei Emeltchenko authored
Add direction parameter to phylink_add since it is anyway set later. Signed-off-by:
-
Andrei Emeltchenko authored
Add ctrl_id parameter to amp_ctrl_add since we always set it after function ctrl is created. Signed-off-by:
-
Andrei Emeltchenko authored
Move code dereferencing possible NULL pointer to the check branch. Signed-off-by:
-
Andrei Emeltchenko authored
Check that link key exist before accessing. Signed-off-by:
-
- 01 Oct, 2012 2 commits
-
-
Rami Rosen authored
This patch removes core_data member from hci_dev struct as it is unused. Signed-off-by:
Rami Rosen <ramirose@gmail.com> Acked-by:
Marcel Holtmann <marcel@holtmann.org> Signed-off-by:
-
Andrei Emeltchenko authored
Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR controller and fixes dereference possible NULL pointer. Signed-off-by:
-
- 28 Sep, 2012 5 commits
-
-
Andrei Emeltchenko authored
Add extra check to avoid skb buffer overflow. Fixes crash below: [ 101.030427] ------------[ cut here ]------------ [ 101.030459] kernel BUG at net/core/skbuff.c:127! [ 101.030486] invalid opcode: 0000 [#1] SMP ... [ 101.030806] Pid: 2010, comm: btmrvl_main_ser Not tainted 3.5.0+ #80 Laptop [ 101.030859] EIP: 0060:[<c14f2ba9>] EFLAGS: 00010282 CPU: 0 [ 101.030894] EIP is at skb_put+0x99/0xa0 [ 101.030919] EAX: 00000080 EBX: f129380b ECX: ef923540 EDX: 00000001 [ 101.030956] ESI: f00a4000 EDI: 00001003 EBP: ed4a5efc ESP: ed4a5ecc [ 101.030992] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 101.031024] CR0: 8005003b CR2: 08fca014 CR3: 30960000 CR4: 000407f0 [ 101.031062] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 101.031100] DR6: ffff0ff0 DR7: 00000400 [ 101.031125] Process btmrvl_main_ser (pid: 2010, ti=ed4a4000 task=ef923540 task.ti=ed4a4000) [ 101.031174] Stack: [ 101.031188] c18126f8 c1651938 f853f8d2 00001003 00001003 f1292800 f1292808 f129380b [ 101.031250] f1292940 f00a4000 eddb1280 efc0f9c0 ed4a5f44 f853f8d2 00000040 00000000 [ 101.031312] ef923540 c15ee096 ef923540 eddb12d4 00000004 f00a4000 00000040 00000000 [ 101.031376] Call Trace: [ 101.031396] [<f853f8d2>] ? btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio] [ 101.031444] [<f853f8d2>] btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio] [ 101.031488] [<c15ee096>] ? _raw_spin_unlock_irqrestore+0x36/0x70 [ 101.031526] [<f85a46e4>] btmrvl_service_main_thread+0x244/0x300 [btmrvl] [ 101.031568] [<f853fb50>] ? btmrvl_sdio_poll_card_status.isra.6.constprop.7+0x90/0x90 [btmrvl_sdio] [ 101.031619] [<c107eda0>] ? try_to_wake_up+0x270/0x270 [ 101.031648] [<f85a44a0>] ? btmrvl_process_event+0x3b0/0x3b0 [btmrvl] [ 101.031686] [<c106d19d>] kthread+0x7d/0x90 [ 101.031713] [<c106d120>] ? flush_kthread_work+0x150/0x150 [ 101.031745] [<c15f5a82>] kernel_thread_helper+0x6/0x10 ... [ 101.032008] EIP: [<c14f2ba9>] skb_put+0x99/0xa0 SS:ESP 0068:ed4a5ecc [ 101.056125] ---[ end trace a0bd01d1a9a796c8 ]--- Signed-off-by:
-
Andrei Emeltchenko authored
The kernel.h macro DIV_ROUND_UP performs the computation (((n) + (d) - 1) / (d)) Signed-off-by:
-
Andrei Emeltchenko authored
Make code readable by correcting name from buf_block_len to num_blocks since it represent number of blocks; NOT a length of a block buffer. Signed-off-by:
-
Andrei Emeltchenko authored
Correct assoc_len and fix warning for x86-64 by using %zu specifier. Reported-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
-
Andrei Emeltchenko authored
Correct warnings Reported-by:
-
- 27 Sep, 2012 25 commits
-
-
Andrei Emeltchenko authored
Use function to factor out similar code. For BR/EDR send EFS Configuration Response immediately, for HS response will be sent after receiving HCI Logical Link Complete event in the following patches. Signed-off-by:
-
Andrei Emeltchenko authored
Use hci_chan as parameter instead of hci_conn as we need logical handle from hci_chan for AMP link. Signed-off-by:
-
Andrei Emeltchenko authored
batostr is not needed anymore since for printing Bluetooth addresses we use %pMR specifier. Signed-off-by:
-
Andrei Emeltchenko authored
Use new bluetooth address print specifier %pMR for printing bluetooth addresses instead of dedicated variable and baswap. Signed-off-by:
-
Andrei Emeltchenko authored
Instead of old unsafe batostr function use %pMR print specifier for printing Bluetooth addresses in sprintf and seq_printf statements. Signed-off-by:
-
Andrei Emeltchenko authored
Instead of old unsafe batostr function use %pMR print specifier for printing Bluetooth addresses in debug and error statements. Signed-off-by:
-
Jefferson Delfes authored
The unpair process tries to disconnect any connection pending with remote. If there are some connection in connecting state, disconnect command will fail and unpair mgmt command will stay pending. That pending mgmt command can cause strange behavior like automatic unpair after a lost connection. Signed-off-by:
Jefferson Delfes <jefferson.delfes@openbossa.org> Acked-by:
Johan Hedberg <johan.hedberg@intel.com> Signed-off-by:
-
Gustavo Padovan authored
We just need to use the right modifiers Signed-off-by: -
Andrei Emeltchenko authored
When receiving HCI Command Status event for Accept Physical Link execute HCI Write Remote AMP Assoc with data saved from A2MP Create Physical Link Request. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Create Physical Link message execute HCI Accept Physical Link command to AMP controller. Signed-off-by:
-
Andrei Emeltchenko authored
Channel Selected event indicates that link information data is available. Read it with Read Local AMP Assoc command. The data shall be sent in the A2MP Create Physical Link Request. Signed-off-by:
-
Andrei Emeltchenko authored
When there is no remote AMP controller found fallback to normal L2CAP sequence. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving HCI Command Status after HCI Create Physical Link execute HCI Write Remote AMP Assoc command to AMP controller. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Get AMP Assoc Response execute HCI Create Physical Link to AMP controller. Define function which will run when receiving HCI Command Status. Signed-off-by:
-
Andrei Emeltchenko authored
Function calculates AMP keys using hmac_sha256 helper. Calculated keys are Generic AMP Link Key (gamp) and Dedicated AMP Link Key with keyID "802b" for 802.11 PAL. Signed-off-by:
-
Dmitry Kasatkin authored
hmac(sha256) will be used for AMP key generation. Signed-off-by:
Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by:
-
Andrei Emeltchenko authored
Choose which L2CAP connection to establish by checking support for HS and remote side supported features. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Get AMP Assoc Response save assoc data to remote AMP controller list and prepare for creating physical link. Signed-off-by:
-
Andrei Emeltchenko authored
Process A2MP Getinfo Response, send Get AMP Assoc Req. Signed-off-by:
-
Andrei Emeltchenko authored
Use hci_conn structure to keep track about AMP physical connections. Signed-off-by:
-
Andrei Emeltchenko authored
Create remote AMP controllers structure. It is used to keep information about discovered remote AMP controllers by A2MP protocol. Signed-off-by:
-
Andrei Emeltchenko authored
Define physical link structures. Physical links are represented by hci_conn structure. For BR/EDR we use type ACL_LINK and for AMP we use AMP_LINK. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Discover Response send A2MP Get Info Request for each AMP controller in the discovery list. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Get AMP Assoc Request execute Read Local AMP Assoc HCI command to AMP controller. If the AMP Assoc data is larger than it can fit to HCI event only fragment is read. When all fragments are read send A2MP Get AMP Assoc Response. Signed-off-by:
-
Andrei Emeltchenko authored
When receiving A2MP Get Info Request execute Read Local AMP Info HCI command to AMP controller with function to be executed upon receiving command complete event. Function will handle A2MP Get Info Response. Signed-off-by:
-
