linux-toradex.git/drivers/bluetooth, branch v2.6.25-rc2

hci_ldisc: fix null pointer deref

2008-02-13T01:54:16+00:00

Arjan:

  With the help of kerneloops.org I've spotted a nice little interaction
  between the TTY layer and the bluetooth code, however the tty layer is not
  something I'm all too familiar with so I rather ask than brute-force fix the
  code incorrectly.

  The raw details are at:
  http://www.kerneloops.org/search.php?search=uart_flush_buffer

  What happens is that, on closing the bluetooth tty, the tty layer goes
  into the release_dev() function, which first does a bunch of stuff, then
  sets the file->private_data to NULL, does some more stuff and then calls the
  ldisc close function.  Which in this case, is hci_uart_tty_close().

  Now, hci_uart_tty_close() calls hci_uart_close() which clears some
  internal bit, and then calls hci_uart_flush()...  which calls back to the
  tty layers' uart_flush_buffer() function.  (in drivers/bluetooth/hci_tty.c
  around line 194) Which then WARN_ON()'s because that's not allowed/supposed
  to be called this late in the shutdown of the port....

  Should the bluetooth driver even call this flush function at all??

David:

  This seems to be what happens: Hci_uart_close() flushes using
  hci_uart_flush().  Subsequently, in hci_dev_do_close(), (one step in
  hci_unregister_dev()), hci_uart_flush() is called again.  The comment in
  uart_flush_buffer(), relating to the WARN_ON(), indicates you can't flush
  after the port is closed; which sounds reasonable.  I think hci_uart_close()
  should set hdev->flush to NULL before returning.  Hci_dev_do_close() does
  check for this.  The code path is rather involved and I'm not entirely clear
  of all steps, but I think that's what should be done.

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2008-02-05T18:09:07+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)
  [PKT_SCHED]: vlan tag match
  [NET]: Add if_addrlabel.h to sanitized headers.
  [NET] rtnetlink.c: remove no longer used functions
  [ICMP]: Restore pskb_pull calls in receive function
  [INET]: Fix accidentally broken inet(6)_hash_connect's port offset calculations.
  [NET]: Remove further references to net-modules.txt
  bluetooth rfcomm tty: destroy before tty_close()
  bluetooth: blacklist another Broadcom BCM2035 device
  drivers/bluetooth/btsdio.c: fix double-free
  drivers/bluetooth/bpa10x.c: fix memleak
  bluetooth: uninlining
  bluetooth: hidp_process_hid_control remove unnecessary parameter dealing
  tun: impossible to deassert IFF_ONE_QUEUE or IFF_NO_PI
  hamradio: fix dmascc section mismatch
  [SCTP]: Fix kernel panic while received AUTH chunk with BAD shared key identifier
  [SCTP]: Fix kernel panic while received AUTH chunk while enabled auth
  [IPV4]: Formatting fix for /proc/net/fib_trie.
  [IPV6]: Fix sysctl compilation error.
  [NET_SCHED]: Add #ifdef CONFIG_NET_EMATCH in net/sched/cls_flow.c (latest git broken build)
  [IPV4]: Fix compile error building without CONFIG_FS_PROC
  ...

pcmcia: replace kio_addr_t with unsigned int everywhere

2008-02-05T17:44:08+00:00

Remove kio_addr_t, and replace it with unsigned int.  No known architecture
needs more than 32 bits for IO addresses and ports and having a separate type
for it is just messy.

Signed-off-by: Olof Johansson 
Cc: Christoph Hellwig 
Cc: Matthew Wilcox 
Cc: Alan Cox 
Cc: Dominik Brodowski 
Cc: Benjamin Herrenschmidt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

bluetooth: blacklist another Broadcom BCM2035 device

2008-02-05T11:10:02+00:00

This device is recognized as bluetooth, but still not works.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

drivers/bluetooth/btsdio.c: fix double-free

2008-02-05T11:09:17+00:00

This patch fixes a double-free spotted by the Coverity checker.

Signed-off-by: Adrian Bunk 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

drivers/bluetooth/bpa10x.c: fix memleak

2008-02-05T11:08:45+00:00

This patch fixea a memleak spotted by the Coverity checker.

Signed-off-by: Adrian Bunk 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

drivers/bluetooth/: Spelling fixes

2008-02-03T15:10:31+00:00

Signed-off-by: Joe Perches 
Signed-off-by: Adrian Bunk

[BLUETOOTH]: Always send explicit hci_ll wake-up acks.

2008-01-11T06:24:43+00:00

In the (rare) event of simultaneous mutual wake up requests,
do send the chip an explicit wake-up ack. This is required
for Texas Instruments's BRF6350 chip.

Signed-off-by: Ohad Ben-Cohen 
Signed-off-by: David S. Miller

[Bluetooth] Add generic driver for Bluetooth USB devices

2007-10-22T09:59:46+00:00

This patch adds a new generic driver for Bluetooth USB devices. This
driver is still experimental at this point, but it is cleaner and
easier to maintain than the current Bluetooth USB driver. It is a
much better starting point for power management improvements.

Signed-off-by: Marcel Holtmann

[Bluetooth] Add generic driver for Bluetooth SDIO devices

2007-10-22T09:59:45+00:00

This patch adds a generic driver for Bluetooth SDIO devices. It
supports Type-A and Type-B devices.

Signed-off-by: David Vrabel 
Signed-off-by: Marcel Holtmann