linux-toradex.git/net/bluetooth, branch v2.6.38.8

Bluetooth: Fix HCI_RESET command synchronization

2011-04-21T21:32:59+00:00

commit f630cf0d5434e3923e1b8226ffa2753ead6b0ce5 upstream.

We can't send new commands before a cmd_complete for the HCI_RESET command
shows up.

Reported-by: Mikko Vinni 
Reported-by: Justin P. Mattock 
Reported-by: Ed Tomlinson 
Signed-off-by: Gustavo F. Padovan 
Tested-by: Justin P. Mattock 
Tested-by: Mikko Vinni 
Tested-by: Ed Tomlinson

Bluetooth: bnep: fix buffer overflow

2011-04-14T20:02:29+00:00

commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.

Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: sco: fix information leak to userspace

2011-04-14T20:02:27+00:00

commit c4c896e1471aec3b004a693c689f60be3b17ac86 upstream.

struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Release BTM while sleeping to avoid deadlock

2011-02-16T18:54:11+00:00

Signed-off-by: Vladislav P 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Set conn state to BT_DISCONN to avoid multiple responses

2011-02-02T14:47:59+00:00

This patch fixes a minor issue that two connection responses will be sent
for one L2CAP connection request. If the L2CAP connection request is first
blocked due to security reason and responded with reason "security block",
the state of the connection remains BT_CONNECT2. If a pairing procedure
completes successfully before the ACL connection is down, local host will
send another connection complete response. See the following packets
captured by hcidump.

2010-12-07 22:21:24.928096 < ACL data: handle 12 flags 0x00 dlen 16
    0000: 0c 00 01 00 03 19 08 00  41 00 53 00 03 00 00 00  ........A.S.....
... ...

2010-12-07 22:21:35.791747 > HCI Event: Auth Complete (0x06) plen 3
    status 0x00 handle 12
... ...

2010-12-07 22:21:35.872372 > ACL data: handle 12 flags 0x02 dlen 16
    L2CAP(s): Connect rsp: dcid 0x0054 scid 0x0040 result 0 status 0
      Connection successful

Signed-off-by: Liang Bao 
Acked-by: Ville Tervo 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Fix race condition with conn->sec_level

2011-01-19T16:43:11+00:00

The conn->sec_level value is supposed to represent the current level of
security that the connection has. However, by assigning to it before
requesting authentication it will have the wrong value during the
authentication procedure. To fix this a pending_sec_level variable is
added which is used to track the desired security level while making
sure that sec_level always represents the current level of security.

Signed-off-by: Johan Hedberg 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Fix authentication request for L2CAP raw sockets

2011-01-19T16:40:43+00:00

When there is an existing connection l2cap_check_security needs to be
called to ensure that the security level of the new socket is fulfilled.
Normally l2cap_do_start takes care of this, but that function doesn't
get called for SOCK_RAW type sockets. This patch adds the necessary
l2cap_check_security call to the appropriate branch in l2cap_do_connect.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Create a unified auth_type evaluation function

2011-01-19T16:40:43+00:00

The logic for determining the needed auth_type for an L2CAP socket is
rather complicated and has so far been duplicated in
l2cap_check_security as well as l2cap_do_connect. Additionally the
l2cap_check_security code was completely missing the handling of
SOCK_RAW type sockets. This patch creates a unified function for the
evaluation and makes l2cap_do_connect and l2cap_check_security use that
function.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Fix MITM protection requirement preservation

2011-01-19T16:40:43+00:00

If an existing connection has a MITM protection requirement (the first
bit of the auth_type) then that requirement should not be cleared by new
sockets that reuse the ACL but don't have that requirement.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan

Revert "Bluetooth: Update sec_level/auth_type for already existing connections"

2011-01-19T16:40:42+00:00

This reverts commit 045309820afe047920a50de25634dab46a1e851d. That
commit is wrong for two reasons:

- The conn->sec_level shouldn't be updated without performing
authentication first (as it's supposed to represent the level of
security that the existing connection has)

- A higher auth_type value doesn't mean "more secure" like the commit
seems to assume. E.g. dedicated bonding with MITM protection is 0x03
whereas general bonding without MITM protection is 0x04. hci_conn_auth
already takes care of updating conn->auth_type so hci_connect doesn't
need to do it.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo F. Padovan