linux-toradex.git/net/bluetooth/smp.c, branch v3.7

Bluetooth: Fix error status when pairing fails

2012-11-09T15:45:37+00:00

When pairing fails due to wrong confirm value, the management layer
doesn't report a proper error status. It sends
MGMT_STATUS_CONNECT_FAILED instead of MGMT_STATUS_AUTH_FAILED.

Most of management functions that receive a status as a parameter
expects for it to be encoded as a HCI status. But when a SMP pairing
fails, the SMP layer sends the SMP reason as the error status to the
management layer.

This commit maps all SMP reasons to HCI_ERROR_AUTH_FAILURE, which will
be converted to MGMT_STATUS_AUTH_FAILED in the management layer.

Reported-by: Claudio Takahasi 
Reviewed-by: João Paulo Rechi Vita 
Signed-off-by: Paulo Sérgio 
Signed-off-by: Gustavo Padovan

Bluetooth: SMP: Fix setting unknown auth_req bits

2012-10-12T09:55:20+00:00

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg 
Cc: stable@kernel.org
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan

Bluetooth: Change signature of smp_conn_security()

2012-08-27T15:07:18+00:00

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan

Bluetooth: Fix use-after-free bug in SMP

2012-08-15T04:06:23+00:00

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [] ? free_obj_work+0x4a/0x7f
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x241/0x241
 [] debug_check_no_obj_freed+0x92/0x159
 [] slab_free_hook+0x6f/0x77
 [] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [] kfree+0x59/0xac
 [] l2cap_conn_del+0x148/0x157 [bluetooth]
 [] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [] ? trace_hardirqs_on_caller+0x112/0x1ad
 [] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [] hci_rx_work+0x235/0x33c [bluetooth]
 [] ? process_one_work+0x126/0x2fe
 [] process_one_work+0x185/0x2fe
 [] ? process_one_work+0x126/0x2fe
 [] ? lock_acquired+0x1b5/0x1cf
 [] ? le_scan_work+0x11d/0x11d [bluetooth]
 [] ? spin_lock_irq+0x9/0xb
 [] worker_thread+0xcf/0x175
 [] ? rescuer_thread+0x175/0x175
 [] kthread+0x95/0x9d
 [] kernel_threadi_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? flush_kthread_worker+0xdb/0xdb
 [] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan

Bluetooth: smp: Fix possible NULL dereference

2012-08-06T18:19:37+00:00

smp_chan_create might return NULL so we need to check before
dereferencing smp.

Signed-off-by: Andrei Emeltchenko 
Signed-off-by: Gustavo Padovan

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

2012-06-13T19:35:35+00:00

Conflicts:
	drivers/net/wireless/ath/ath9k/main.c
	net/bluetooth/hci_event.c

Bluetooth: Fix SMP security elevation from medium to high

2012-06-08T06:58:34+00:00

If we have an unauthenticated key it is not sufficient to acheive high
security. Therefore, when deciding whether to encrypt the link or
request pairing, it is essential to in addition to checking the
existence of a key to also check whether it is authenticated or not.

Signed-off-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan

Bluetooth: Fix SMP pairing method selection

2012-06-08T04:50:15+00:00

The tk_request function takes the local IO capability as the second last
parameter and the remote IO capability as the last parameter. They were
previously swapped: when we receive a pairing response
req->io_capability contains the local one and rsp->io_capability the
remote one.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan

Bluetooth: Remove unnecessary headers include

2012-06-05T03:34:08+00:00

Most of the include were unnecessary or already included by some other
header.
Replace module.h by export.h where possible.

Signed-off-by: Gustavo Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Correct ediv in SMP

2012-05-09T03:41:30+00:00

ediv is already in little endian order.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg