- 18 Oct, 2012 1 commit
-
-
Andrei Emeltchenko authored
When assigning amp_mgr in hci_conn (type AMP_LINK) get also reference. In hci_conn_del those references would be put for both conn types AMP_LINK and ACL_LINK associated with amp_mgr. Signed-off-by:
Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by:
Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-
- 15 Oct, 2012 8 commits
-
-
Andrei Emeltchenko authored
If BREDR L2CAP chan is deleted and this chan is the channel through which High Speed traffic is routed to AMP then zero pointer to the chan in amp_mgr to prevent accessing it. Signed-off-by:
-
Andrei Emeltchenko authored
Do not send EFS Configuration Response for High Speed channel yet. It will be sent after receiving Logical Link Complete event. Signed-off-by:
Marcel Holtmann <marcel@holtmann.org> Signed-off-by:
-
Andrei Emeltchenko authored
High Speed hci_conn should always have l2cap_conn associated with it. Signed-off-by:
-
Andrei Emeltchenko authored
Check flags type in switch statement and handle new frame type ACL_COMPLETE used for High Speed data over AMP. Signed-off-by:
-
Andrei Emeltchenko authored
For AMP HCI controller use Logical Link handle in HCI ACL Handle field. Signed-off-by:
-
Gustavo Padovan authored
Use of "__" usually means we need to call the function with a lock held, which is not the case here. Acked-by:
-
Gustavo Padovan authored
When DEFER_SETUP is set defer() will trigger an authorization request to the userspace. l2cap_chan_no_defer() is meant to be used when one does not want to support DEFER_SETUP (A2MP for example). Acked-by:
-
Gustavo Padovan authored
This is part of the move the parent socket usage to l2cap_sock.c The change is safe when it comes to locking, bt_accept_enqueue() is still protected by the parent socket lock inside the l2cap_sock_new_connection_cb() code. Acked-by:
-
- 12 Oct, 2012 7 commits
-
-
Gustavo Padovan authored
Users that don't implement teardown() should use l2cap_chan_no_teardown() Acked-by:
-
Gustavo Padovan authored
No one was protecting the state set in l2cap_send_disconn_req() Acked-by:
-
Gustavo Padovan authored
l2cap_conn_unreliable() doesn't take the sk lock, so we need to take it using l2cap_chan_set_err(). Acked-by:
-
Gustavo Padovan authored
Since we change the Bluetooth core to run in process context we don't need to use GFP_ATOMIC in many of places we were using it. The we just replace by GFP_KERNEL. Acked-by:
-
Gustavo Padovan authored
Follow the net subsystem coding style Acked-by:
-
Mat Martineau authored
L2CAP connect requests and create channel requests share a significant amount of code. This change moves common code to a new function. Signed-off-by:
Mat Martineau <mathewm@codeaurora.org> Signed-off-by:
-
Mat Martineau authored
Signed-off-by:
-
- 11 Oct, 2012 9 commits
-
-
Andrei Emeltchenko authored
Handle AMP link when setting up disconnect timeout. Signed-off-by:
-
Andrei Emeltchenko authored
AMP_LINK represents physical link between AMP controllers. Signed-off-by:
-
Andrei Emeltchenko authored
Add handling blocks count for AMP link. Signed-off-by:
-
Andrei Emeltchenko authored
hci_chan will be identified by handle used in logical link creation process. This handle is used in AMP ACL-U packet handle field. Signed-off-by:
-
Andrei Emeltchenko authored
When AMP_LINK timeouts execute HCI_OP_DISCONN_PHY_LINK as analog to HCI_OP_DISCONNECT for ACL_LINK. Signed-off-by:
-
Andrei Emeltchenko authored
Enable setting of flush timeout via setsockopt Signed-off-by:
-
Syam Sidhardhan authored
Since the RFCOMM_PSM is constant, __constant_cpu_to_le16() is the right go here. Signed-off-by:
Syam Sidhardhan <s.syam@samsung.com> Acked-by:
-
Syam Sidhardhan authored
Since the L2CAP_CID_SMP is constant, __constant_cpu_to_le16() is the right go here. Signed-off-by:
-
Andrei Emeltchenko authored
Use standard print specifier and remove print_hex_dump_bytes call. Makes output more sensible: ... [18809.401218] 00000000: 0b 00 00 fe 5b fc 01 f2 00 00 00 ....[...... ... would be changed to ... [18809.401218] Bluetooth: hex: 0b 00 00 fe 5b fc 01 f2 00 00 00 ... Signed-off-by:
-
- 09 Oct, 2012 1 commit
-
-
Sasha Levin authored
We may currently attempt to free a channel which wasn't created due to an error in the initialization path, this would cause a NULL ptr deref. This would cause the following oops: [ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 12.919131] IP: [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919135] PGD 0 [ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 12.919193] Dumping ftrace buffer: [ 12.919242] (ftrace buffer empty) [ 12.919314] Modules linked in: [ 12.919318] CPU 1 [ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30 [ 12.919374] RIP: 0010:[<ffffffff836645c4>] [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246 [ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667 [ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010 [ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001 [ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000 [ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001 [ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000 [ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0 [ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000) [ 12.919506] Stack: [ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc [ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae [ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200 [ 12.919517] Call Trace: [ 12.919522] [<ffffffff8366c7bc>] l2cap_sock_destruct+0x3c/0x80 [ 12.919527] [<ffffffff833ae0ae>] __sk_free+0x1e/0x1f0 [ 12.919530] [<ffffffff833ae2f7>] sk_free+0x17/0x20 [ 12.919585] [<ffffffff8366ca4e>] l2cap_sock_alloc.constprop.5+0x9e/0xd0 [ 12.919591] [<ffffffff8366cb9e>] l2cap_sock_create+0x7e/0x100 [ 12.919652] [<ffffffff83a4f32a>] ? _raw_read_lock+0x6a/0x80 [ 12.919658] [<ffffffff836402c4>] ? bt_sock_create+0x74/0x110 [ 12.919660] [<ffffffff83640308>] bt_sock_create+0xb8/0x110 [ 12.919664] [<ffffffff833aa232>] __sock_create+0x282/0x3b0 [ 12.919720] [<ffffffff833aa0b0>] ? __sock_create+0x100/0x3b0 [ 12.919725] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919779] [<ffffffff833aa37f>] sock_create_kern+0x1f/0x30 [ 12.919784] [<ffffffff83675714>] rfcomm_l2sock_create+0x44/0x70 [ 12.919787] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919790] [<ffffffff836785fe>] rfcomm_run+0x4e/0x1f0 [ 12.919846] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919852] [<ffffffff81138ee3>] kthread+0xe3/0xf0 [ 12.919908] [<ffffffff8117b12e>] ? put_lock_stats.isra.14+0xe/0x40 [ 12.919914] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.919968] [<ffffffff83a5077c>] ret_from_fork+0x7c/0x90 [ 12.919973] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80 ac 3a fe 48 8d 7b 10 <f0> 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08 [ 12.920165] RIP [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.920166] RSP <ffff880066933c38> [ 12.920167] CR2: 0000000000000010 [ 12.920417] ---[ end trace 5a9114e8a158ab84 ]--- Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan reference counting"). Signed-off-by:
Sasha Levin <sasha.levin@oracle.com> Signed-off-by:
-
- 08 Oct, 2012 1 commit
-
-
Andrei Emeltchenko authored
There are two Flush Timeouts: one is old Flush Timeot Option which is 2 octets and the second is Flush Timeout inside EFS which is 4 octets long. Signed-off-by:
-
- 07 Oct, 2012 6 commits
-
-
Andrei Emeltchenko authored
Maximum PDU size is defined by new BT Spec as 1492 octets. Signed-off-by:
-
Andrei Emeltchenko authored
Signed-off-by:
-
Andrei Emeltchenko authored
Add direction parameter to phylink_add since it is anyway set later. Signed-off-by:
-
Andrei Emeltchenko authored
Add ctrl_id parameter to amp_ctrl_add since we always set it after function ctrl is created. Signed-off-by:
-
Andrei Emeltchenko authored
Move code dereferencing possible NULL pointer to the check branch. Signed-off-by:
-
Andrei Emeltchenko authored
Check that link key exist before accessing. Signed-off-by:
-
- 01 Oct, 2012 2 commits
-
-
Rami Rosen authored
This patch removes core_data member from hci_dev struct as it is unused. Signed-off-by:
Rami Rosen <ramirose@gmail.com> Acked-by:
-
Andrei Emeltchenko authored
Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR controller and fixes dereference possible NULL pointer. Signed-off-by:
-
- 28 Sep, 2012 5 commits
-
-
Andrei Emeltchenko authored
Add extra check to avoid skb buffer overflow. Fixes crash below: [ 101.030427] ------------[ cut here ]------------ [ 101.030459] kernel BUG at net/core/skbuff.c:127! [ 101.030486] invalid opcode: 0000 [#1] SMP ... [ 101.030806] Pid: 2010, comm: btmrvl_main_ser Not tainted 3.5.0+ #80 Laptop [ 101.030859] EIP: 0060:[<c14f2ba9>] EFLAGS: 00010282 CPU: 0 [ 101.030894] EIP is at skb_put+0x99/0xa0 [ 101.030919] EAX: 00000080 EBX: f129380b ECX: ef923540 EDX: 00000001 [ 101.030956] ESI: f00a4000 EDI: 00001003 EBP: ed4a5efc ESP: ed4a5ecc [ 101.030992] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 101.031024] CR0: 8005003b CR2: 08fca014 CR3: 30960000 CR4: 000407f0 [ 101.031062] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 101.031100] DR6: ffff0ff0 DR7: 00000400 [ 101.031125] Process btmrvl_main_ser (pid: 2010, ti=ed4a4000 task=ef923540 task.ti=ed4a4000) [ 101.031174] Stack: [ 101.031188] c18126f8 c1651938 f853f8d2 00001003 00001003 f1292800 f1292808 f129380b [ 101.031250] f1292940 f00a4000 eddb1280 efc0f9c0 ed4a5f44 f853f8d2 00000040 00000000 [ 101.031312] ef923540 c15ee096 ef923540 eddb12d4 00000004 f00a4000 00000040 00000000 [ 101.031376] Call Trace: [ 101.031396] [<f853f8d2>] ? btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio] [ 101.031444] [<f853f8d2>] btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio] [ 101.031488] [<c15ee096>] ? _raw_spin_unlock_irqrestore+0x36/0x70 [ 101.031526] [<f85a46e4>] btmrvl_service_main_thread+0x244/0x300 [btmrvl] [ 101.031568] [<f853fb50>] ? btmrvl_sdio_poll_card_status.isra.6.constprop.7+0x90/0x90 [btmrvl_sdio] [ 101.031619] [<c107eda0>] ? try_to_wake_up+0x270/0x270 [ 101.031648] [<f85a44a0>] ? btmrvl_process_event+0x3b0/0x3b0 [btmrvl] [ 101.031686] [<c106d19d>] kthread+0x7d/0x90 [ 101.031713] [<c106d120>] ? flush_kthread_work+0x150/0x150 [ 101.031745] [<c15f5a82>] kernel_thread_helper+0x6/0x10 ... [ 101.032008] EIP: [<c14f2ba9>] skb_put+0x99/0xa0 SS:ESP 0068:ed4a5ecc [ 101.056125] ---[ end trace a0bd01d1a9a796c8 ]--- Signed-off-by:
-
Andrei Emeltchenko authored
The kernel.h macro DIV_ROUND_UP performs the computation (((n) + (d) - 1) / (d)) Signed-off-by:
-
Andrei Emeltchenko authored
Make code readable by correcting name from buf_block_len to num_blocks since it represent number of blocks; NOT a length of a block buffer. Signed-off-by:
-
Andrei Emeltchenko authored
Correct assoc_len and fix warning for x86-64 by using %zu specifier. Reported-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
-
Andrei Emeltchenko authored
Correct warnings Reported-by:
-
