<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net/bluetooth, branch v2.6.23.17</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>[BLUETOOTH]: Fix non-COMPAT build of hci_sock.c</title>
<updated>2007-09-12T12:10:58+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@kimchee.(none)</email>
</author>
<published>2007-09-12T12:10:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1da97f83a843f92678b614fcaebdb3e4ebd6c9dd'/>
<id>1da97f83a843f92678b614fcaebdb3e4ebd6c9dd</id>
<content type='text'>
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[Bluetooth] Fix parameter list for event filter command</title>
<updated>2007-09-09T06:39:49+00:00</updated>
<author>
<name>Marcel Holtmann</name>
<email>marcel@holtmann.org</email>
</author>
<published>2007-09-09T06:39:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=89f2783ded0a4fc98852cb9552bb27a80cd6a41a'/>
<id>89f2783ded0a4fc98852cb9552bb27a80cd6a41a</id>
<content type='text'>
On device initialization the event filters are cleared. In case of
clearing the filters the extra condition type shall be omitted.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On device initialization the event filters are cleared. In case of
clearing the filters the extra condition type shall be omitted.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[Bluetooth] Update security filter for Bluetooth 2.1</title>
<updated>2007-09-09T06:39:43+00:00</updated>
<author>
<name>Marcel Holtmann</name>
<email>marcel@holtmann.org</email>
</author>
<published>2007-09-09T06:39:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7c631a67601f116d303cfb98a3d964a150090e38'/>
<id>7c631a67601f116d303cfb98a3d964a150090e38</id>
<content type='text'>
This patch updates the HCI security filter with support for the
Bluetooth 2.1 commands and events.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch updates the HCI security filter with support for the
Bluetooth 2.1 commands and events.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[Bluetooth] Add compat handling for timestamp structure</title>
<updated>2007-09-09T06:39:34+00:00</updated>
<author>
<name>Marcel Holtmann</name>
<email>marcel@holtmann.org</email>
</author>
<published>2007-09-09T06:39:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=767c5eb5d35aeb85987143f0a730bc21d3ecfb3d'/>
<id>767c5eb5d35aeb85987143f0a730bc21d3ecfb3d</id>
<content type='text'>
The timestamp structure needs special handling in case of compat
programs. Use the same wrapping method the network core uses.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The timestamp structure needs special handling in case of compat
programs. Use the same wrapping method the network core uses.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[BLUETOOTH] l2cap: don't mangle cmd.len</title>
<updated>2007-07-31T09:28:09+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2007-07-29T07:18:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d83852822cb58f0beaa2d06b7c1e9e005e0c4f94'/>
<id>d83852822cb58f0beaa2d06b7c1e9e005e0c4f94</id>
<content type='text'>
Since nobody uses it after we convert it to host-endian,
no need to do that at all.  At that point l2cap is endian-clean.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since nobody uses it after we convert it to host-endian,
no need to do that at all.  At that point l2cap is endian-clean.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[BLUETOOTH]: pass (host-endian) cmd length as explicit argument to l2cap_conf_req()</title>
<updated>2007-07-31T09:28:08+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2007-07-29T07:17:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=88219a0f65ae14ba744fa424604c965b6f1c1a8d'/>
<id>88219a0f65ae14ba744fa424604c965b6f1c1a8d</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[BLUETOOTH] l2cap: endianness annotations</title>
<updated>2007-07-31T09:28:07+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2007-07-29T07:16:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8e036fc3143646dc304356fa50314681d654363f'/>
<id>8e036fc3143646dc304356fa50314681d654363f</id>
<content type='text'>
no code changes, just documenting existing types

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
no code changes, just documenting existing types

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[BLUETOOTH]: Fix endianness bug in l2cap_sock_listen()</title>
<updated>2007-07-31T09:28:06+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2007-07-29T07:15:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6dc0c2082b8acf30c9239fbbcc051eebdaf7ecff'/>
<id>6dc0c2082b8acf30c9239fbbcc051eebdaf7ecff</id>
<content type='text'>
We loop through psm values, calling __l2cap_get_sock_by_addr(psm, ...)
until we get NULL; then we set -&gt;psm of our socket to htobs(psm).
IOW, we find unused psm value and put it into our socket.  So far, so
good, but...  __l2cap_get_sock_by_addr() compares its argument with
-&gt;psm of sockets.  IOW, the entire thing works correctly only on
little-endian.  On big-endian we'll get "no socket with such psm"
on the first iteration, since we won't find a socket with -&gt;psm == 0x1001.
We will happily conclude that 0x1001 is unused and slap htobs(0x1001)
(i.e. 0x110) into -&gt;psm of our socket.  Of course, the next time around
the same thing will repeat and we'll just get a fsckload of sockets
with the same -&gt;psm assigned.

Fix: pass htobs(psm) to __l2cap_get_sock_by_addr() there.  All other
callers are already passing little-endian values and all places that
store something in -&gt;psm are storing little-endian.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We loop through psm values, calling __l2cap_get_sock_by_addr(psm, ...)
until we get NULL; then we set -&gt;psm of our socket to htobs(psm).
IOW, we find unused psm value and put it into our socket.  So far, so
good, but...  __l2cap_get_sock_by_addr() compares its argument with
-&gt;psm of sockets.  IOW, the entire thing works correctly only on
little-endian.  On big-endian we'll get "no socket with such psm"
on the first iteration, since we won't find a socket with -&gt;psm == 0x1001.
We will happily conclude that 0x1001 is unused and slap htobs(0x1001)
(i.e. 0x110) into -&gt;psm of our socket.  Of course, the next time around
the same thing will repeat and we'll just get a fsckload of sockets
with the same -&gt;psm assigned.

Fix: pass htobs(psm) to __l2cap_get_sock_by_addr() there.  All other
callers are already passing little-endian values and all places that
store something in -&gt;psm are storing little-endian.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[IRDA]: Fix rfcomm use-after-free</title>
<updated>2007-07-31T09:28:05+00:00</updated>
<author>
<name>Marcel Holtmann</name>
<email>marcel@holtmann.org</email>
</author>
<published>2007-07-26T07:12:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=09c7d8293a2d1317d16ef4ddb9f6dd2553d0694e'/>
<id>09c7d8293a2d1317d16ef4ddb9f6dd2553d0694e</id>
<content type='text'>
Adrian Bunk wrote:
&gt; Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following
&gt; use-after-free in net/bluetooth/rfcomm/tty.c:
&gt;
&gt; &lt;--  snip  --&gt;
&gt;
&gt; ...
&gt; static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
&gt; {
&gt; ...
&gt;         if (IS_ERR(dev-&gt;tty_dev)) {
&gt;                 list_del(&amp;dev-&gt;list);
&gt;                 kfree(dev);
&gt;                 return PTR_ERR(dev-&gt;tty_dev);
&gt;         }
&gt; ...
&gt;
&gt; &lt;--  snip  --&gt;
&gt;
&gt; Spotted by the Coverity checker.

really good catch. I fully overlooked that one. The attached patch
should fix it.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Adrian Bunk wrote:
&gt; Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following
&gt; use-after-free in net/bluetooth/rfcomm/tty.c:
&gt;
&gt; &lt;--  snip  --&gt;
&gt;
&gt; ...
&gt; static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
&gt; {
&gt; ...
&gt;         if (IS_ERR(dev-&gt;tty_dev)) {
&gt;                 list_del(&amp;dev-&gt;list);
&gt;                 kfree(dev);
&gt;                 return PTR_ERR(dev-&gt;tty_dev);
&gt;         }
&gt; ...
&gt;
&gt; &lt;--  snip  --&gt;
&gt;
&gt; Spotted by the Coverity checker.

really good catch. I fully overlooked that one. The attached patch
should fix it.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[NET] BLUETOOTH: Fix whitespace errors.</title>
<updated>2007-07-19T01:43:16+00:00</updated>
<author>
<name>YOSHIFUJI Hideaki</name>
<email>yoshfuji@linux-ipv6.org</email>
</author>
<published>2007-07-19T01:43:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=00ae02f31519e8d6e374424bbdf0c7381489e416'/>
<id>00ae02f31519e8d6e374424bbdf0c7381489e416</id>
<content type='text'>
Signed-off-by: YOSHIFUJI Hideaki &lt;yoshfuji@linux-ipv6.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: YOSHIFUJI Hideaki &lt;yoshfuji@linux-ipv6.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
