linux-toradex.git/net/bluetooth, branch v2.6.32.50

tty: icount changeover for other main devices

2011-11-26T17:10:38+00:00

commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 upstream

Again basically cut and paste

Convert the main driver set to use the hooks for GICOUNT

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Dan Carpenter

Bluetooth: Prevent buffer overflow in l2cap config request

2011-11-07T20:32:51+00:00

commit 7ac28817536797fd40e9646452183606f9e17f71 upstream.

A remote user can provide a small value for the command size field in
the command header of an l2cap configuration request, resulting in an
integer underflow when subtracting the size of the configuration request
header.  This results in copying a very large amount of data via
memcpy() and destroying the kernel heap.  Check for underflow.

Signed-off-by: Dan Rosenberg 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.

2011-11-07T20:32:48+00:00

commit 8d03e971cf403305217b8e62db3a2e5ad2d6263f upstream.

Structures "l2cap_conninfo" and "rfcomm_conninfo" have one padding
byte each. This byte in "cinfo" is copied to userspace uninitialized.

Signed-off-by: Filip Palian 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: bnep: fix buffer overflow

2011-04-14T23:53:33+00:00

commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.

Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: sco: fix information leak to userspace

2011-04-14T23:53:32+00:00

commit c4c896e1471aec3b004a693c689f60be3b17ac86 upstream.

struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix kernel crash on L2CAP stress tests

2010-04-01T22:58:55+00:00

commit c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 upstream.

Added very simple check that req buffer has enough space to
fit configuration parameters. Shall be enough to reject packets
with configuration size more than req buffer.

Crash trace below

[ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
[ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
...
[ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
[ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
...
[ 6070.030303] Backtrace:
[ 6070.032806] [] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
[] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
[ 6070.043823]  r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
[ 6070.050659] [] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
[] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
[ 6070.061798] [] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
[] (hci_rx_task+0x244/0x478 [bluetooth])
[ 6070.072631]  r6:dc647700 r5:00000001 r4:df2ab740
[ 6070.077362] [] (hci_rx_task+0x0/0x478 [bluetooth]) from
[] (tasklet_action+0x78/0xd8)
[ 6070.087005] [] (tasklet_action+0x0/0xd8) from []

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix potential bad memory access with sysfs files

2010-04-01T22:58:54+00:00

commit 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 upstream.

When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.

Based on initial patches from Neil Brown and Linus Torvalds

Reported-by: Neil Brown 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix sleeping function in RFCOMM within invalid context

2010-04-01T22:58:10+00:00

commit 485f1eff73a7b932fd3abb0dfcf804e1a1f59025 upstream.

With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:

BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P           2.6.32 #31
Call Trace:
   [] __might_sleep+0xf8/0xfa
 [] lock_sock_nested+0x29/0xc4
 [] lock_sock+0xb/0xd [l2cap]
 [] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
 [] ? clockevents_program_event+0x75/0x7e
 [] ? tick_dev_program_event+0x37/0xa5
 [] l2cap_sock_release+0x27/0x67 [l2cap]
 [] sock_release+0x1a/0x67
 [] rfcomm_session_del+0x34/0x53 [rfcomm]
 [] rfcomm_session_put+0x14/0x16 [rfcomm]
 [] rfcomm_session_timeout+0xe/0x1a [rfcomm]
 [] run_timer_softirq+0x1e2/0x29a
 [] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
 [] __do_softirq+0xfe/0x1c5
 [] ? timer_interrupt+0x1a/0x21
 [] call_softirq+0x1c/0x28
 [] do_softirq+0x33/0x6b
 [] irq_exit+0x36/0x85
 [] do_IRQ+0xa6/0xbd
 [] ret_from_intr+0x0/0xa
   [] ? acpi_idle_enter_bm+0x269/0x294
 [] ? acpi_idle_enter_bm+0x25f/0x294
 [] ? cpuidle_idle_call+0x97/0x107
 [] ? cpu_idle+0x53/0xaa
 [] ? rest_init+0x7a/0x7c
 [] ? start_kernel+0x389/0x394
 [] ? x86_64_start_reservations+0xac/0xb0
 [] ? x86_64_start_kernel+0xe4/0xeb

To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.

Signed-off-by: Marcel Holtmann 
Tested-by: David John 
Cc: Chase Douglas 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix regression with L2CAP configuration in Basic Mode

2009-11-16T00:31:41+00:00

Basic Mode is the default mode of operation of a L2CAP entity. In
this case the RFC (Retransmission and Flow Control) configuration
option should not be used at all.

Normally remote L2CAP implementation should just ignore this option,
but it can cause various side effects with other Bluetooth stacks
that are not capable of handling unknown options.

Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Select Basic Mode as default for SOCK_SEQPACKET

2009-11-16T00:31:16+00:00

The default mode for SOCK_SEQPACKET is Basic Mode. So when no
mode has been specified, Basic Mode shall be used.

This is important for current application to keep working as
expected and not cause a regression.

Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann