aboutsummaryrefslogtreecommitdiff
path: root/net/bluetooth
AgeCommit message (Collapse)AuthorFilesLines
2013-03-18Bluetooth: Use an async request for mgmt_set_connectableJohan Hedberg1-8/+29
This patch changes the mgmt_set_connectable handler to use an async request for sending the required HCI command. This is necessary preparation for handling the fast connectable change that needs to be associated with disabling the connectable setting. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix setting local name to the existing valueJohan Hedberg1-0/+11
If user space attempts to set the local name to the same value that's already set we should simply return a direct command complete for this mgmt command. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix local name setting for LE-only controllersJohan Hedberg1-2/+9
This patch fixes the mgmt_set_local_name command to send the appropriate HCI commands based on BR/EDR support and LE support. Local name and EIR data should only be sent for BR/EDR capable controllers whereas an update to the AD should only happen for LE capable controllers. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Handle AD updating through an async requestJohan Hedberg2-29/+19
For proper control of the AD update and the related HCI commands it's best to run the AD update through an async request instead of a standalone HCI command. This patch changes the hci_update_ad() function to take a request pointer and updates its users appropriately. E.g. the function is no longer called after the init sequence but during stage 3 of the init sequence. The TX power is read during the init sequence, so we don't need an explicit update whenever it is read and the AD update based on the local name should be done through the local name mgmt handler. The only other user is the update based on enabling advertising. This part is still kept as there is no mgmt API to enable it. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix waiting for EIR update when setting local nameJohan Hedberg1-47/+49
We shouldn't respond to the mgmt_set_local_name command until all related HCI commands have completed. This patch fixes the issue by running the local name HCI command and the EIR update in the same asynchronous request, and returning the mgmt command complete through the complete callback of the request. The downside of this is that we must set hdev->dev_name before the local name HCI command has completed since otherwise the generated EIR command doesn't contain the new name. This means that we can no-longer reliably detect when the name has really changed and when not. Luckily this only affects scenarios where the mgmt interface is *not* used (e.g. hciconfig) so redundant mgmt_ev_local_name_changed events in these cases are an acceptable drawback. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix clearing flags on power off before notifying mgmtJohan Hedberg1-4/+4
When powering off the device the hdev->flags and hdev->dev_flags need to be cleared before calling mgmt_powered(). If this is not done the resulting events sent to user space may contain incorrect values. Note that the HCI_AUTO_OFF flag accessed right after this is part of the persistent flags, so it's unchanged by the hdev->dev_flags reset. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Clear non-persistent flags when closing HCI deviceJohan Hedberg1-0/+1
When hci_dev_do_close() is called we should make sure to clear all non-persistent flags in hci->dev_flags. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Add a define for the HCI persistent flags maskJohan Hedberg1-1/+1
We'll need to use this mask also when powering off the HCI device so it's better to have this in a single and visible place. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Remove useless HCI_PENDING_CLASS flagJohan Hedberg2-6/+1
Now that class related operations are tracked through asynchronous HCI requests this flag is no longer needed. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix UUID/class mgmt command response synchronizationJohan Hedberg1-17/+56
We should only return a mgmt command complete once all HCI commands to a mgmt_set_dev_class or mgmt_add/remove_uuid command have completed. This patch fixes the issue by having a proper async request complete callback for these actions and responding to user space in the callback. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Fix busy condition testing for EIR and class updatesJohan Hedberg1-9/+36
The add/remove_uuid and set_dev_class mgmt commands can trigger both EIR and class HCI commands, so testing just for a pending class command is enough. The simplest way to monitor conflicts that should trigger "busy" error returns is to check for any pending mgmt command that can trigger these HCI commands. This patch adds a helper function for this (pending_eir_or_class) and uses it instead of the old HCI_PENDING_CLASS flag to test for busy conditions. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Wait for HCI command completion with mgmt_set_poweredJohan Hedberg1-12/+34
We should only notify user space that the adapter has been powered on after all HCI commands related to the action have completed. This patch fixes the issue by instating an async request complete callback for these HCI commands and only notifies user space in the callback. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Update mgmt powered HCI commands to use async requestsJohan Hedberg1-63/+100
This patch updates sending of HCI commands related to mgmt_set_powered (e.g. class, name and EIR data) to be sent using asynchronous requests. This is necessary since it's the only (well, at least the cleanest) way to keep the power on procedure synchronized and let user space know it has completed only when all HCI commands are completed (this actual fix is coming in a subsequent patch). Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Move power on HCI command updates to their own functionJohan Hedberg1-36/+42
These commands will in a subsequent patch be performed in their own asynchronous request, so it's more readable (not just from a resulting code perspective but also the way the patches look like) to have them performed in their own function. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Replaced kzalloc and memcpy with kmemdupAlexandru Gheorghiu1-4/+2
Replaced calls to kzalloc followed by memcpy with a single call to kmemdup. Signed-off-by: Alexandru Gheorghiu <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-18Bluetooth: Use PTR_RET functionAlexandru Gheorghiu1-3/+1
Used PTR_RET function instead of IS_ERR and PTR_ERR. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-14Bluetooth: Fix not closing SCO sockets in the BT_CONNECT2 stateVinicius Costa Gomes1-0/+1
With deferred setup for SCO, it is possible that userspace closes the socket when it is in the BT_CONNECT2 state, after the Connect Request is received but before the Accept Synchonous Connection is sent. If this happens the following crash was observed, when the connection is terminated: [ +0.000003] hci_sync_conn_complete_evt: hci0 status 0x10 [ +0.000005] sco_connect_cfm: hcon ffff88003d1bd800 bdaddr 40:98:4e:32:d7:39 status 16 [ +0.000003] sco_conn_del: hcon ffff88003d1bd800 conn ffff88003cc8e300, err 110 [ +0.000015] BUG: unable to handle kernel NULL pointer dereference at 0000000000000199 [ +0.000906] IP: [<ffffffff810620dd>] __lock_acquire+0xed/0xe82 [ +0.000000] PGD 3d21f067 PUD 3d291067 PMD 0 [ +0.000000] Oops: 0002 [#1] SMP [ +0.000000] Modules linked in: rfcomm bnep btusb bluetooth [ +0.000000] CPU 0 [ +0.000000] Pid: 1481, comm: kworker/u:2H Not tainted 3.9.0-rc1-25019-gad82cdd #1 Bochs Bochs [ +0.000000] RIP: 0010:[<ffffffff810620dd>] [<ffffffff810620dd>] __lock_acquire+0xed/0xe82 [ +0.000000] RSP: 0018:ffff88003c3c19d8 EFLAGS: 00010002 [ +0.000000] RAX: 0000000000000001 RBX: 0000000000000246 RCX: 0000000000000000 [ +0.000000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003d1be868 [ +0.000000] RBP: ffff88003c3c1a98 R08: 0000000000000002 R09: 0000000000000000 [ +0.000000] R10: ffff88003d1be868 R11: ffff88003e20b000 R12: 0000000000000002 [ +0.000000] R13: ffff88003aaa8000 R14: 000000000000006e R15: ffff88003d1be850 [ +0.000000] FS: 0000000000000000(0000) GS:ffff88003e200000(0000) knlGS:0000000000000000 [ +0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ +0.000000] CR2: 0000000000000199 CR3: 000000003c1cb000 CR4: 00000000000006b0 [ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ +0.000000] Process kworker/u:2H (pid: 1481, threadinfo ffff88003c3c0000, task ffff88003aaa8000) [ +0.000000] Stack: [ +0.000000] ffffffff81b16342 0000000000000000 0000000000000000 ffff88003d1be868 [ +0.000000] ffffffff00000000 00018c0c7863e367 000000003c3c1a28 ffffffff8101efbd [ +0.000000] 0000000000000000 ffff88003e3d2400 ffff88003c3c1a38 ffffffff81007c7a [ +0.000000] Call Trace: [ +0.000000] [<ffffffff8101efbd>] ? kvm_clock_read+0x34/0x3b [ +0.000000] [<ffffffff81007c7a>] ? paravirt_sched_clock+0x9/0xd [ +0.000000] [<ffffffff81007fd4>] ? sched_clock+0x9/0xb [ +0.000000] [<ffffffff8104fd7a>] ? sched_clock_local+0x12/0x75 [ +0.000000] [<ffffffff810632d1>] lock_acquire+0x93/0xb1 [ +0.000000] [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth] [ +0.000000] [<ffffffff8105f3d8>] ? lock_release_holdtime.part.22+0x4e/0x55 [ +0.000000] [<ffffffff814f6038>] _raw_spin_lock+0x40/0x74 [ +0.000000] [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth] [ +0.000000] [<ffffffff814f6936>] ? _raw_spin_unlock+0x23/0x36 [ +0.000000] [<ffffffffa0022339>] spin_lock+0x9/0xb [bluetooth] [ +0.000000] [<ffffffffa00230cc>] sco_conn_del+0x76/0xbb [bluetooth] [ +0.000000] [<ffffffffa002391d>] sco_connect_cfm+0x2da/0x2e9 [bluetooth] [ +0.000000] [<ffffffffa000862a>] hci_proto_connect_cfm+0x38/0x65 [bluetooth] [ +0.000000] [<ffffffffa0008d30>] hci_sync_conn_complete_evt.isra.79+0x11a/0x13e [bluetooth] [ +0.000000] [<ffffffffa000cd96>] hci_event_packet+0x153b/0x239d [bluetooth] [ +0.000000] [<ffffffff814f68ff>] ? _raw_spin_unlock_irqrestore+0x48/0x5c [ +0.000000] [<ffffffffa00025f6>] hci_rx_work+0xf3/0x2e3 [bluetooth] [ +0.000000] [<ffffffff8103efed>] process_one_work+0x1dc/0x30b [ +0.000000] [<ffffffff8103ef83>] ? process_one_work+0x172/0x30b [ +0.000000] [<ffffffff8103e07f>] ? spin_lock_irq+0x9/0xb [ +0.000000] [<ffffffff8103fc8d>] worker_thread+0x123/0x1d2 [ +0.000000] [<ffffffff8103fb6a>] ? manage_workers+0x240/0x240 [ +0.000000] [<ffffffff81044211>] kthread+0x9d/0xa5 [ +0.000000] [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60 [ +0.000000] [<ffffffff814f75bc>] ret_from_fork+0x7c/0xb0 [ +0.000000] [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60 [ +0.000000] Code: d7 44 89 8d 50 ff ff ff 4c 89 95 58 ff ff ff e8 44 fc ff ff 44 8b 8d 50 ff ff ff 48 85 c0 4c 8b 95 58 ff ff ff 0f 84 7a 04 00 00 <f0> ff 80 98 01 00 00 83 3d 25 41 a7 00 00 45 8b b5 e8 05 00 00 [ +0.000000] RIP [<ffffffff810620dd>] __lock_acquire+0xed/0xe82 [ +0.000000] RSP <ffff88003c3c19d8> [ +0.000000] CR2: 0000000000000199 [ +0.000000] ---[ end trace e73cd3b52352dd34 ]--- Cc: [email protected] [3.8] Signed-off-by: Vinicius Costa Gomes <[email protected]> Tested-by: Frederic Dalleau <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Fix endianness handling of cmd_status/complete opcodesJohan Hedberg1-4/+4
The opcode in cmd_complete and cmd_status events is 16 bits, so we should only be comparing it after having converted it to the host endianness. There's already an opcode variable in both functions which is in host endiannes so the right fix is to just start using it instead of ev->opcode. Signed-off-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Check req->err in hci_req_addAndre Guedes1-0/+6
If req->err is set, there is no point in queueing the HCI command in HCI request command queue since it won't be sent anyway. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Make hci_req_add returning voidAndre Guedes1-4/+2
Since no one checks the returning value of hci_req_add and HCI request errors are now handled in hci_req_run, we can make hci_ req_add returning void. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: HCI request error handlingAndre Guedes1-1/+12
When we are building a HCI request with more than one HCI command and one of the hci_req_add calls fail, we should have some cleanup routine so the HCI commands already queued on HCI request can be deleted. Otherwise, we will face some memory leaks issues. This patch implements the HCI request error handling which is the following: If a hci_req_add fails, we save the error code in hci_ request. Once hci_req_run is called, we verify the error field. If it is different from zero, we delete all HCI commands already queued and return the error code. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Check hci_req_run returning value in __hci_req_syncAndre Guedes1-6/+9
Since hci_req_run will be returning more than one error code, we should check its returning value in __hci_req_sync. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Return ENODATA in hci_req_runAndre Guedes1-1/+1
In case the HCI request queue is empty, hci_req_run should return ENODATA instead of EINVAL. This way, hci_req_run returns a more meaningful error value. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-09Bluetooth: Fix __hci_req_syncAndre Guedes1-4/+3
If hci_req_run returns error, we erroneously leave the current process in TASK_INTERRUPTABLE state. If we leave the process in TASK_INTERRUPTABLE and it is preempted, this process will never be scheduled again. This patch fixes this issue by moving the preparation for scheduling (add to waitqueue and set process state) to just after the hci_req_run call. Signed-off-by: Andre Guedes <[email protected]> Acked-by: Johan Hedberg <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Remove empty HCI event handlersJohan Hedberg1-164/+0
With the removal of hci_req_complete() several HCI event handlers have essentially become empty and can be removed. The only potential benefit of these could have been logging, but the hci_event, hci_cmd_complete and hci_cmd_status already provide a log for events which they do not have an explicit handler for. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Remove unused hdev->init_last_cmdJohan Hedberg1-6/+0
This variable is no longer needed (due to async HCI request support and the conversion of hci_req_sync to use it), so it can be safely removed. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Use async requests internally in hci_req_syncJohan Hedberg2-193/+156
This patch converts the hci_req_sync() procedure to internaly use the asynchronous HCI requests. The hci_req_sync mechanism relies on hci_req_complete() calls from hci_event.c into hci_core.c whenever a HCI command completes. This is very similar to what asynchronous requests do and makes the conversion fairly straight forward by converting hci_req_complete into a request complete callback. By this change hci_req_complete (renamed to hci_req_sync_complete) becomes private to hci_core.c and all calls to it can be removed from hci_event.c. The commands in each hci_req_sync procedure are collected into their own request by passing the hci_request pointer to the request callback (instead of the hci_dev pointer). The one slight exception is the HCI init request which has the special handling of HCI driver specific initialization commands. These commands are run in their own request prior to the "main" init request. One other extra change that this patch must contain is the handling of spontaneous HCI reset complete events that some controllers exhibit. These were previously handled in the hci_req_complete function but the right place for them now becomes the hci_req_cmd_complete function. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Add request cmd_complete and cmd_status functionsJohan Hedberg2-0/+92
This patch introduces functions to process the HCI request state when receiving HCI Command Status or Command Complete events. Some HCI commands, like Inquiry do not result in a Command complete event so special handling is needed for them. Inquiry is a particularly important one since it is the only forseeable "non-cmd_complete" command that will make good use of the request functionality, and its completion is either indicated by an Inquiry Complete event of a successful Command Complete for HCI_Inquiry_Cancel. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Fix stand-alone HCI command handlingJohan Hedberg2-0/+10
To have a consistent content for hdev->cmd_q all entries need to follow the semantics of asynchronous HCI requests. This means that even single commands need to be dressed as requests by having a request start indicator. This patch adds these indicators to the two places needing it (hci_send_cmd and hci_sock_sendmsg). Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Introduce new hci_req_add functionJohan Hedberg1-0/+22
This function is analogous to hci_send_cmd() but instead of directly queuing the command to hdev->cmd_q it adds it to the local queue of the asynchronous HCI request being build (inside struct hci_request). This is the main function used for building asynchronous requests and there should be one or more calls to it between calls to hci_req_init and hci_req_run. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Refactor HCI command skb creationJohan Hedberg1-8/+20
This patch moves out the skb creation from hci_send_cmd() into its own prepare_cmd() function. This is essential so the same prepare_cmd() function can be easily reused for skb creation for asynchronous HCI requests. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Add initial skeleton for asynchronous HCI requestsJohan Hedberg1-0/+30
This patch adds the initial definitions and functions for asynchronous HCI requests. Asynchronous requests are essentially a group of HCI commands together with an optional completion callback. The request is tracked through the already existing command queue by having the necessary context information as part of the control buffer of each skb. The only information needed in the skb control buffer is a flag for indicating that the skb is the start of a request as well as the optional complete callback that should be used when the request is complete (this will be found in the last skb of the request). Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Split HCI init sequence into three stagesJohan Hedberg2-255/+274
Having conditional command sending during a request has always been problematic and caused hacks like the hdev->init_last_cmd variable. This patch removes these conditionals and instead splits the init sequence into three stages, each with its own __hci_req_sync() call. This also paves the way to the upcoming asynchronous request support swhich will also benefit by having a simpler implementation if it doesn't need to cater for requests that change on the fly. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Fix __hci_req_sync() handling of empty requestsJohan Hedberg1-0/+8
If a request callback doesn't send any commands __hci_req_sync() should fail imediately instead of waiting for the inevitable timeout to occur. This is particularly important once we start creating requests with conditional command sending which can potentially result in no commands being sent at all. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Rename hci_request to hci_req_syncJohan Hedberg1-24/+25
We'll be introducing an async version of hci_request. To make things clear it makes sense to rename the existing API to have a _sync suffix. Signed-off-by: Johan Hedberg <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Remove redundant RFCOMM BT_CLOSED settingsDean Jenkins1-5/+2
rfcomm_session_close() sets the RFCOMM session state to BT_CLOSED. However, in multiple places immediately before the function is called, the RFCOMM session is set to BT_CLOSED. Therefore, remove these unnecessary state settings. Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Remove redundant call to rfcomm_send_discDean Jenkins1-3/+0
In rfcomm_session_del() remove the redundant call to rfcomm_send_disc() because it is not possible for the session to be in BT_CONNECTED state during deletion of the session. Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Remove RFCOMM session refcntDean Jenkins1-38/+5
Previous commits have improved the handling of the RFCOMM session timer and the RFCOMM session pointers such that freed RFCOMM session structures should no longer be erroneously accessed. The RFCOMM session refcnt now has no purpose and will be deleted by this commit. Note that the RFCOMM session is now deleted as soon as the RFCOMM control channel link is no longer required. This makes the lifetime of the RFCOMM session deterministic and absolute. Previously with the refcnt, there was uncertainty about when the session structure would be deleted because the relative refcnt prevented the session structure from being deleted at will. It was noted that the refcnt could malfunction under very heavy real-time processor loading in embedded SMP environments. This could cause premature RFCOMM session deletion or double session deletion that could result in kernel crashes. Removal of the refcnt prevents this issue. There are 4 connection / disconnection RFCOMM session scenarios: host initiated control link ---> host disconnected control link host initiated ctrl link ---> remote device disconnected ctrl link remote device initiated ctrl link ---> host disconnected ctrl link remote device initiated ctrl link ---> remote device disc'ed ctrl link The control channel connection procedures are independent of the disconnection procedures. Strangely, the RFCOMM session refcnt was applying special treatment so erroneously combining connection and disconnection events. This commit fixes this issue by removing some session code that used the "initiator" member of the session structure that was intended for use with the data channels. Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Return RFCOMM session ptrs to avoid freed sessionDean Jenkins1-50/+56
Unfortunately, the design retains local copies of the s RFCOMM session pointer in various code blocks and this invites the erroneous access to a freed RFCOMM session structure. Therefore, return the RFCOMM session pointer back up the call stack to avoid accessing a freed RFCOMM session structure. When the RFCOMM session is deleted, NULL is passed up the call stack. If active DLCs exist when the rfcomm session is terminating, avoid a memory leak of rfcomm_dlc structures by ensuring that rfcomm_session_close() is used instead of rfcomm_session_del(). Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Check rfcomm session and DLC exists on socket closeDean Jenkins1-2/+24
A race condition exists between near simultaneous asynchronous DLC data channel disconnection requests from the host and remote device. This causes the socket layer to request a socket shutdown at the same time the rfcomm core is processing the disconnect request from the remote device. The socket layer retains a copy of a struct rfcomm_dlc d pointer. The d pointer refers to a copy of a struct rfcomm_session. When the socket layer thread performs a socket shutdown, the thread may wait on a rfcomm lock in rfcomm_dlc_close(). This means that whilst the thread waits, the rfcomm_session and/or rfcomm_dlc structures pointed to by d maybe freed due to rfcomm core handling. Consequently, when the rfcomm lock becomes available and the thread runs, a malfunction could occur as a freed rfcomm_session structure and/or a freed rfcomm_dlc structure will be erroneously accessed. Therefore, after the rfcomm lock is acquired, check that the struct rfcomm_session is still valid by searching the rfcomm session list. If the session is valid then validate the d pointer by searching the rfcomm session list of active DLCs for the rfcomm_dlc structure pointed by d. Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Avoid rfcomm_session_timeout using freed sessionDean Jenkins1-1/+1
Use del_timer_sync() instead of del_timer() as this ensures that rfcomm_session_timeout() is not running on a different CPU when rfcomm_session_put() is called. This avoids a race condition on SMP systems because potentially rfcomm_session_timeout() could reuse the freed RFCOMM session structure caused by the execution of rfcomm_session_put(). Note that this modification makes the reason for the RFCOMM session refcnt mechanism redundant. Signed-off-by: Dean Jenkins <[email protected]> Acked-by: Marcel Holtmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: change bt_sock_unregister() to return voidDavid Herrmann1-12/+3
There is no reason a caller ever wants to check the return type of this call. _Iff_ a user successfully called bt_sock_register(), they're allowed to call bt_sock_unregister(). All other calls in the kernel (device_del, device_unregister, kfree(), ..) that are logically equivalent return void. Lets not make callers think they have to check the return type of this call and instead simply return void. We guarantee that after bt_sock_unregister() is called, the socket type _is_ unregistered. If that is not what the caller wants, they're using the wrong function, anyway. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: discard bt_sock_unregister() errorsDavid Herrmann7-19/+7
After we successfully registered a socket via bt_sock_register() there is no reason to ever check the return code of bt_sock_unregister(). If bt_sock_unregister() fails, it means the socket _is_ already unregistered so we have what we want, don't we? Also, to get bt_sock_unregister() to fail, another part of the kernel has to unregister _our_ socket. This is sooo _wrong_ that it will break way earlier than when we unregister our socket. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Make hidp_get_raw_report abort if the session is terminatingKarl Relton1-0/+4
After linux 3.2 the hid_destroy_device call in hidp_session cleaning up invokes a hook to the power_supply code which in turn tries to read the battery capacity. This read will trigger a call to hidp_get_raw_report which is bound to fail because the device is being taken away - so rather than wait for the 5 second timeout failure this changes enables it to fail straight away. Signed-off-by: Karl Relton <[email protected]> Reviewed-by: David Herrmann <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-03-08Bluetooth: Rename hci_acl_disconnAndre Guedes3-5/+5
As hci_acl_disconn function basically sends the HCI Disconnect Command and it is used to disconnect ACL, SCO and LE links, renaming it to hci_disconnect is more suitable. Signed-off-by: Andre Guedes <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
2013-02-27hlist: drop the node parameter from iteratorsSasha Levin3-27/+15
I'm not sure why, but the hlist for each entry iterators were conceived list_for_each_entry(pos, head, member) The hlist ones were greedy and wanted an extra parameter: hlist_for_each_entry(tpos, pos, head, member) Why did they need an extra pos parameter? I'm not quite sure. Not only they don't really need it, it also prevents the iterator from looking exactly like the list iterator, which is unfortunate. Besides the semantic patch, there was some manual work required: - Fix up the actual hlist iterators in linux/list.h - Fix up the declaration of other iterators based on the hlist ones. - A very small amount of places were using the 'node' parameter, this was modified to use 'obj->member' instead. - Coccinelle didn't handle the hlist_for_each_entry_safe iterator properly, so those had to be fixed up manually. The semantic patch which is mostly the work of Peter Senna Tschudin is here: @@ iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host; type T; expression a,c,d,e; identifier b; statement S; @@ -T b; <+... when != b ( hlist_for_each_entry(a, - b, c, d) S | hlist_for_each_entry_continue(a, - b, c) S | hlist_for_each_entry_from(a, - b, c) S | hlist_for_each_entry_rcu(a, - b, c, d) S | hlist_for_each_entry_rcu_bh(a, - b, c, d) S | hlist_for_each_entry_continue_rcu_bh(a, - b, c) S | for_each_busy_worker(a, c, - b, d) S | ax25_uid_for_each(a, - b, c) S | ax25_for_each(a, - b, c) S | inet_bind_bucket_for_each(a, - b, c) S | sctp_for_each_hentry(a, - b, c) S | sk_for_each(a, - b, c) S | sk_for_each_rcu(a, - b, c) S | sk_for_each_from -(a, b) +(a) S + sk_for_each_from(a) S | sk_for_each_safe(a, - b, c, d) S | sk_for_each_bound(a, - b, c) S | hlist_for_each_entry_safe(a, - b, c, d, e) S | hlist_for_each_entry_continue_rcu(a, - b, c) S | nr_neigh_for_each(a, - b, c) S | nr_neigh_for_each_safe(a, - b, c, d) S | nr_node_for_each(a, - b, c) S | nr_node_for_each_safe(a, - b, c, d) S | - for_each_gfn_sp(a, c, d, b) S + for_each_gfn_sp(a, c, d) S | - for_each_gfn_indirect_valid_sp(a, c, d, b) S + for_each_gfn_indirect_valid_sp(a, c, d) S | for_each_host(a, - b, c) S | for_each_host_safe(a, - b, c, d) S | for_each_mesh_entry(a, - b, c, d) S ) ...+> [[email protected]: drop bogus change from net/ipv4/raw.c] [[email protected]: drop bogus hunk from net/ipv6/raw.c] [[email protected]: checkpatch fixes] [[email protected]: fix warnings] [[email protected]: redo intrusive kvm changes] Tested-by: Peter Senna Tschudin <[email protected]> Acked-by: Paul E. McKenney <[email protected]> Signed-off-by: Sasha Levin <[email protected]> Cc: Wu Fengguang <[email protected]> Cc: Marcelo Tosatti <[email protected]> Cc: Gleb Natapov <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-02-21Merge branch 'for-linus' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial Pull trivial tree from Jiri Kosina: "Assorted tiny fixes queued in trivial tree" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (22 commits) DocBook: update EXPORT_SYMBOL entry to point at export.h Documentation: update top level 00-INDEX file with new additions ARM: at91/ide: remove unsused at91-ide Kconfig entry percpu_counter.h: comment code for better readability x86, efi: fix comment typo in head_32.S IB: cxgb3: delay freeing mem untill entirely done with it net: mvneta: remove unneeded version.h include time: x86: report_lost_ticks doesn't exist any more pcmcia: avoid static analysis complaint about use-after-free fs/jfs: Fix typo in comment : 'how may' -> 'how many' of: add missing documentation for of_platform_populate() btrfs: remove unnecessary cur_trans set before goto loop in join_transaction sound: soc: Fix typo in sound/codecs treewide: Fix typo in various drivers btrfs: fix comment typos Update ibmvscsi module name in Kconfig. powerpc: fix typo (utilties -> utilities) of: fix spelling mistake in comment h8300: Fix home page URL in h8300/README xtensa: Fix home page URL in Kconfig ...
2013-02-21Merge tag 'tty-3.9-rc1' of ↵Linus Torvalds2-13/+9
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial patches from Greg Kroah-Hartman: "Here's the big tty/serial driver patches for 3.9-rc1. More tty port rework and fixes from Jiri here, as well as lots of individual serial driver updates and fixes. All of these have been in the linux-next tree for a while." * tag 'tty-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (140 commits) tty: mxser: improve error handling in mxser_probe() and mxser_module_init() serial: imx: fix uninitialized variable warning serial: tegra: assume CONFIG_OF TTY: do not update atime/mtime on read/write lguest: select CONFIG_TTY to build properly. ARM defconfigs: add missing inclusions of linux/platform_device.h fb/exynos: include platform_device.h ARM: sa1100/assabet: include platform_device.h directly serial: imx: Fix recursive locking bug pps: Fix build breakage from decoupling pps from tty tty: Remove ancient hardpps() pps: Additional cleanups in uart_handle_dcd_change pps: Move timestamp read into PPS code proper pps: Don't crash the machine when exiting will do pps: Fix a use-after free bug when unregistering a source. pps: Use pps_lookup_dev to reduce ldisc coupling pps: Add pps_lookup_dev() function tty: serial: uartlite: Support uartlite on big and little endian systems tty: serial: uartlite: Fix sparse and checkpatch warnings serial/arc-uart: Miscll DT related updates (Grant's review comments) ... Fix up trivial conflicts, mostly just due to the TTY config option clashing with the EXPERIMENTAL removal.
2013-02-18net: proc: change proc_net_remove to remove_proc_entryGao feng1-1/+1
proc_net_remove is only used to remove proc entries that under /proc/net,it's not a general function for removing proc entries of netns. if we want to remove some proc entries which under /proc/net/stat/, we still need to call remove_proc_entry. this patch use remove_proc_entry to replace proc_net_remove. we can remove proc_net_remove after this patch. Signed-off-by: Gao feng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-02-18net: proc: change proc_net_fops_create to proc_createGao feng1-1/+1
Right now, some modules such as bonding use proc_create to create proc entries under /proc/net/, and other modules such as ipv4 use proc_net_fops_create. It looks a little chaos.this patch changes all of proc_net_fops_create to proc_create. we can remove proc_net_fops_create after this patch. Signed-off-by: Gao feng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.