linux-toradex.git/net/bluetooth, branch v3.4.67

Bluetooth: Fix encryption key size for peripheral role

2013-10-13T22:42:48+00:00

commit 89cbb4da0abee2f39d75f67f9fd57f7410c8b65c upstream.

This patch fixes the connection encryption key size information when
the host is playing the peripheral role. We should set conn->enc_key_
size in hci_le_ltk_request_evt, otherwise it is left uninitialized.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix security level for peripheral role

2013-10-13T22:42:48+00:00

commit f8776218e8546397be64ad2bc0ebf4748522d6e3 upstream.

While playing the peripheral role, the host gets a LE Long Term Key
Request Event from the controller when a connection is established
with a bonded device. The host then informs the LTK which should be
used for the connection. Once the link is encrypted, the host gets
an Encryption Change Event.

Therefore we should set conn->pending_sec_level instead of conn->
sec_level in hci_le_ltk_request_evt. This way, conn->sec_level is
properly updated in hci_encrypt_change_evt.

Moreover, since we have a LTK associated to the device, we have at
least BT_SECURITY_MEDIUM security level.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix crash in l2cap_build_cmd() with small MTU

2013-07-03T17:59:00+00:00

commit 300b962e5244a1ea010df7e88595faa0085b461d upstream.

If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.

Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:

[   46.885433] BUG: unable to handle kernel paging request at f56ad000
[   46.888037] IP: [] memcpy+0x1d/0x40
[   46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[   46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[   46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[   46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[   46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[   46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[   46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[   46.888037] EIP: 0060:[] EFLAGS: 00010212 CPU: 0
[   46.888037] EIP is at memcpy+0x1d/0x40
[   46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[   46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[   46.888037]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[   46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[   46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   46.888037] DR6: ffff0ff0 DR7: 00000400
[   46.888037] Stack:
[   46.888037]  fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[   46.888037]  f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[   46.888037]  f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[   46.888037] Call Trace:
[   46.888037]  [] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[   46.888037]  [] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[   46.888037]  [] l2cap_connect+0x3f7/0x540 [bluetooth]
[   46.888037]  [] ? trace_hardirqs_off+0xb/0x10
[   46.888037]  [] ? mark_held_locks+0x68/0x110
[   46.888037]  [] ? mutex_lock_nested+0x280/0x360
[   46.888037]  [] ? __mutex_unlock_slowpath+0xa9/0x150
[   46.888037]  [] ? trace_hardirqs_on_caller+0xec/0x1b0
[   46.888037]  [] ? mutex_lock_nested+0x268/0x360
[   46.888037]  [] ? trace_hardirqs_on+0xb/0x10
[   46.888037]  [] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[   46.888037]  [] ? mark_held_locks+0x68/0x110
[   46.888037]  [] ? __mutex_unlock_slowpath+0xa9/0x150
[   46.888037]  [] ? trace_hardirqs_on_caller+0xec/0x1b0
[   46.888037]  [] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[   46.888037]  [] hci_rx_work+0x518/0x810 [bluetooth]
[   46.888037]  [] ? hci_rx_work+0x132/0x810 [bluetooth]
[   46.888037]  [] process_one_work+0x1a9/0x600
[   46.888037]  [] ? process_one_work+0x12b/0x600
[   46.888037]  [] ? worker_thread+0x19e/0x320
[   46.888037]  [] ? worker_thread+0x19e/0x320
[   46.888037]  [] worker_thread+0xf7/0x320
[   46.888037]  [] ? rescuer_thread+0x290/0x290
[   46.888037]  [] kthread+0xa8/0xb0
[   46.888037]  [] ret_from_kernel_thread+0x1b/0x28
[   46.888037]  [] ? flush_kthread_worker+0x120/0x120
[   46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6  a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[   46.888037] EIP: [] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[   46.888037] CR2: 00000000f56ad000
[   46.888037] ---[ end trace 0217c1f4d78714a9 ]---

Signed-off-by: Anderson Lizardo 
Signed-off-by: Gustavo Padovan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix mgmt handling of power on failures

2013-06-20T18:58:44+00:00

commit 96570ffcca0b872dc8626e97569d2697f374d868 upstream.

If hci_dev_open fails we need to ensure that the corresponding
mgmt_set_powered command gets an appropriate response. This patch fixes
the missing response by adding a new mgmt_set_powered_failed function
that's used to indicate a power on failure to mgmt. Since a situation
with the device being rfkilled may require special handling in user
space the patch uses a new dedicated mgmt status code for this.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()

2013-05-01T16:41:04+00:00

[ Upstream commit e11e0455c0d7d3d62276a0c55d9dfbc16779d691 ]

If RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns
early with 0 without updating the possibly set msg_namelen member. This,
in turn, leads to a 128 byte kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_stream_recvmsg().

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: fix possible info leak in bt_sock_recvmsg()

2013-05-01T16:41:04+00:00

[ Upstream commit 4683f42fde3977bdb4e8a09622788cc8b5313778 ]

In case the socket is already shutting down, bt_sock_recvmsg() returns
with 0 without updating msg_namelen leading to net/socket.c leaking the
local, uninitialized sockaddr_storage variable to userland -- 128 bytes
of kernel stack memory.

Fix this by moving the msg_namelen assignment in front of the shutdown
test.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix not closing SCO sockets in the BT_CONNECT2 state

2013-04-05T17:04:15+00:00

commit eb20ff9c91ddcb2d55c1849a87d3db85af5e88a9 upstream.

With deferred setup for SCO, it is possible that userspace closes the
socket when it is in the BT_CONNECT2 state, after the Connect Request is
received but before the Accept Synchonous Connection is sent.

If this happens the following crash was observed, when the connection is
terminated:

[  +0.000003] hci_sync_conn_complete_evt: hci0 status 0x10
[  +0.000005] sco_connect_cfm: hcon ffff88003d1bd800 bdaddr 40:98:4e:32:d7:39 status 16
[  +0.000003] sco_conn_del: hcon ffff88003d1bd800 conn ffff88003cc8e300, err 110
[  +0.000015] BUG: unable to handle kernel NULL pointer dereference at 0000000000000199
[  +0.000906] IP: [] __lock_acquire+0xed/0xe82
[  +0.000000] PGD 3d21f067 PUD 3d291067 PMD 0
[  +0.000000] Oops: 0002 [#1] SMP
[  +0.000000] Modules linked in: rfcomm bnep btusb bluetooth
[  +0.000000] CPU 0
[  +0.000000] Pid: 1481, comm: kworker/u:2H Not tainted 3.9.0-rc1-25019-gad82cdd #1 Bochs Bochs
[  +0.000000] RIP: 0010:[]  [] __lock_acquire+0xed/0xe82
[  +0.000000] RSP: 0018:ffff88003c3c19d8  EFLAGS: 00010002
[  +0.000000] RAX: 0000000000000001 RBX: 0000000000000246 RCX: 0000000000000000
[  +0.000000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003d1be868
[  +0.000000] RBP: ffff88003c3c1a98 R08: 0000000000000002 R09: 0000000000000000
[  +0.000000] R10: ffff88003d1be868 R11: ffff88003e20b000 R12: 0000000000000002
[  +0.000000] R13: ffff88003aaa8000 R14: 000000000000006e R15: ffff88003d1be850
[  +0.000000] FS:  0000000000000000(0000) GS:ffff88003e200000(0000) knlGS:0000000000000000
[  +0.000000] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  +0.000000] CR2: 0000000000000199 CR3: 000000003c1cb000 CR4: 00000000000006b0
[  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  +0.000000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  +0.000000] Process kworker/u:2H (pid: 1481, threadinfo ffff88003c3c0000, task ffff88003aaa8000)
[  +0.000000] Stack:
[  +0.000000]  ffffffff81b16342 0000000000000000 0000000000000000 ffff88003d1be868
[  +0.000000]  ffffffff00000000 00018c0c7863e367 000000003c3c1a28 ffffffff8101efbd
[  +0.000000]  0000000000000000 ffff88003e3d2400 ffff88003c3c1a38 ffffffff81007c7a
[  +0.000000] Call Trace:
[  +0.000000]  [] ? kvm_clock_read+0x34/0x3b
[  +0.000000]  [] ? paravirt_sched_clock+0x9/0xd
[  +0.000000]  [] ? sched_clock+0x9/0xb
[  +0.000000]  [] ? sched_clock_local+0x12/0x75
[  +0.000000]  [] lock_acquire+0x93/0xb1
[  +0.000000]  [] ? spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [] ? lock_release_holdtime.part.22+0x4e/0x55
[  +0.000000]  [] _raw_spin_lock+0x40/0x74
[  +0.000000]  [] ? spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [] ? _raw_spin_unlock+0x23/0x36
[  +0.000000]  [] spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [] sco_conn_del+0x76/0xbb [bluetooth]
[  +0.000000]  [] sco_connect_cfm+0x2da/0x2e9 [bluetooth]
[  +0.000000]  [] hci_proto_connect_cfm+0x38/0x65 [bluetooth]
[  +0.000000]  [] hci_sync_conn_complete_evt.isra.79+0x11a/0x13e [bluetooth]
[  +0.000000]  [] hci_event_packet+0x153b/0x239d [bluetooth]
[  +0.000000]  [] ? _raw_spin_unlock_irqrestore+0x48/0x5c
[  +0.000000]  [] hci_rx_work+0xf3/0x2e3 [bluetooth]
[  +0.000000]  [] process_one_work+0x1dc/0x30b
[  +0.000000]  [] ? process_one_work+0x172/0x30b
[  +0.000000]  [] ? spin_lock_irq+0x9/0xb
[  +0.000000]  [] worker_thread+0x123/0x1d2
[  +0.000000]  [] ? manage_workers+0x240/0x240
[  +0.000000]  [] kthread+0x9d/0xa5
[  +0.000000]  [] ? __kthread_parkme+0x60/0x60
[  +0.000000]  [] ret_from_fork+0x7c/0xb0
[  +0.000000]  [] ? __kthread_parkme+0x60/0x60
[  +0.000000] Code: d7 44 89 8d 50 ff ff ff 4c 89 95 58 ff ff ff e8 44 fc ff ff 44 8b 8d 50 ff ff ff 48 85 c0 4c 8b 95 58 ff ff ff 0f 84 7a 04 00 00  ff 80 98 01 00 00 83 3d 25 41 a7 00 00 45 8b b5 e8 05 00 00
[  +0.000000] RIP  [] __lock_acquire+0xed/0xe82
[  +0.000000]  RSP 
[  +0.000000] CR2: 0000000000000199
[  +0.000000] ---[ end trace e73cd3b52352dd34 ]---

Signed-off-by: Vinicius Costa Gomes 
Tested-by: Frederic Dalleau 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix handling of unexpected SMP PDUs

2013-02-14T18:48:53+00:00

commit 8cf9fa1240229cbdd888236c0c43fcbad680cf00 upstream.

The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()

2013-02-04T00:24:41+00:00

commit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream.

The length parameter should be sizeof(req->name) - 1 because there is no
guarantee that string provided by userspace will contain the trailing
'\0'.

Can be easily reproduced by manually setting req->name to 128 non-zero
bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
input subsystem:

$ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af

("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
field in struct hid_device due to overflow.)

Signed-off-by: Anderson Lizardo 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix sending HCI commands after reset

2013-02-04T00:24:40+00:00

commit dbccd791a3fbbdac12c33834b73beff3984988e9 upstream.

After sending reset command wait for its command complete event before
sending next command. Some chips sends CC event for command received
before reset if reset was send before chip replied with CC.

This is also required by specification that host shall not send
additional HCI commands before receiving CC for reset.

< HCI Command: Reset (0x03|0x0003) plen 0                              [hci0] 18.404612
> HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.405850
      Write Extended Inquiry Response (0x03|0x0052) ncmd 1
        Status: Success (0x00)
< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.406079
> HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.407864
      Reset (0x03|0x0003) ncmd 1
        Status: Success (0x00)
< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.408062
> HCI Event: Command Complete (0x0e) plen 12                           [hci0] 18.408835

Signed-off-by: Szymon Janc 
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman