Commit Graph

97 Commits

Author SHA1 Message Date
David Newall
3611f4d2a5 hci_ldisc: fix null pointer deref
Arjan:

  With the help of kerneloops.org I've spotted a nice little interaction
  between the TTY layer and the bluetooth code, however the tty layer is not
  something I'm all too familiar with so I rather ask than brute-force fix the
  code incorrectly.

  The raw details are at:
  http://www.kerneloops.org/search.php?search=uart_flush_buffer

  What happens is that, on closing the bluetooth tty, the tty layer goes
  into the release_dev() function, which first does a bunch of stuff, then
  sets the file->private_data to NULL, does some more stuff and then calls the
  ldisc close function.  Which in this case, is hci_uart_tty_close().

  Now, hci_uart_tty_close() calls hci_uart_close() which clears some
  internal bit, and then calls hci_uart_flush()...  which calls back to the
  tty layers' uart_flush_buffer() function.  (in drivers/bluetooth/hci_tty.c
  around line 194) Which then WARN_ON()'s because that's not allowed/supposed
  to be called this late in the shutdown of the port....

  Should the bluetooth driver even call this flush function at all??

David:

  This seems to be what happens: Hci_uart_close() flushes using
  hci_uart_flush().  Subsequently, in hci_dev_do_close(), (one step in
  hci_unregister_dev()), hci_uart_flush() is called again.  The comment in
  uart_flush_buffer(), relating to the WARN_ON(), indicates you can't flush
  after the port is closed; which sounds reasonable.  I think hci_uart_close()
  should set hdev->flush to NULL before returning.  Hci_dev_do_close() does
  check for this.  The code path is rather involved and I'm not entirely clear
  of all steps, but I think that's what should be done.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-12 17:54:16 -08:00
Linus Torvalds
3d412f60b7 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)
  [PKT_SCHED]: vlan tag match
  [NET]: Add if_addrlabel.h to sanitized headers.
  [NET] rtnetlink.c: remove no longer used functions
  [ICMP]: Restore pskb_pull calls in receive function
  [INET]: Fix accidentally broken inet(6)_hash_connect's port offset calculations.
  [NET]: Remove further references to net-modules.txt
  bluetooth rfcomm tty: destroy before tty_close()
  bluetooth: blacklist another Broadcom BCM2035 device
  drivers/bluetooth/btsdio.c: fix double-free
  drivers/bluetooth/bpa10x.c: fix memleak
  bluetooth: uninlining
  bluetooth: hidp_process_hid_control remove unnecessary parameter dealing
  tun: impossible to deassert IFF_ONE_QUEUE or IFF_NO_PI
  hamradio: fix dmascc section mismatch
  [SCTP]: Fix kernel panic while received AUTH chunk with BAD shared key identifier
  [SCTP]: Fix kernel panic while received AUTH chunk while enabled auth
  [IPV4]: Formatting fix for /proc/net/fib_trie.
  [IPV6]: Fix sysctl compilation error.
  [NET_SCHED]: Add #ifdef CONFIG_NET_EMATCH in net/sched/cls_flow.c (latest git broken build)
  [IPV4]: Fix compile error building without CONFIG_FS_PROC
  ...
2008-02-05 10:09:07 -08:00
Olof Johansson
906da809c5 pcmcia: replace kio_addr_t with unsigned int everywhere
Remove kio_addr_t, and replace it with unsigned int.  No known architecture
needs more than 32 bits for IO addresses and ports and having a separate type
for it is just messy.

Signed-off-by: Olof Johansson <olof@lixom.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-05 09:44:08 -08:00
Andy Shevchenko
6e46c8cb3c bluetooth: blacklist another Broadcom BCM2035 device
This device is recognized as bluetooth, but still not works.

Signed-off-by: Andy Shevchenko <andy@smile.org.ua>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-05 03:10:02 -08:00
Adrian Bunk
2fa993423a drivers/bluetooth/btsdio.c: fix double-free
This patch fixes a double-free spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-05 03:09:17 -08:00
Adrian Bunk
cb7cd42930 drivers/bluetooth/bpa10x.c: fix memleak
This patch fixea a memleak spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-05 03:08:45 -08:00
Joe Perches
b92b1c5725 drivers/bluetooth/: Spelling fixes
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
2008-02-03 17:10:31 +02:00
Ohad Ben-Cohen
5c54822665 [BLUETOOTH]: Always send explicit hci_ll wake-up acks.
In the (rare) event of simultaneous mutual wake up requests,
do send the chip an explicit wake-up ack. This is required
for Texas Instruments's BRF6350 chip.

Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-10 22:24:43 -08:00
Marcel Holtmann
5e23b923da [Bluetooth] Add generic driver for Bluetooth USB devices
This patch adds a new generic driver for Bluetooth USB devices. This
driver is still experimental at this point, but it is cleaner and
easier to maintain than the current Bluetooth USB driver. It is a
much better starting point for power management improvements.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:46 -07:00
Marcel Holtmann
ddbaf13e36 [Bluetooth] Add generic driver for Bluetooth SDIO devices
This patch adds a generic driver for Bluetooth SDIO devices. It
supports Type-A and Type-B devices.

Signed-off-by: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:45 -07:00
Jeff Garzik
ac019360fe [Bluetooth] Eliminate checks for impossible conditions in IRQ handler
Our info structure and info->hdev is always passed to the IRQ handler,
so we don't have to worry about these checks in every interrupt.

Leave a BUG_ON() just to help unwary programmers, but these could
probably be removed as well.

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:44 -07:00
Ohad Ben-Cohen
166d2f6a43 [Bluetooth] Add UART driver for Texas Instruments' BRF63xx chips
Add support for Texas Instruments' HCI Low Level (HCILL) Bluetooth
protocol, which is a power management extension to H4. The HCILL is
widely used by TI's BRF63xx Bluetooth chips.

Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:44 -07:00
Marcel Holtmann
e24b21ec85 [Bluetooth] Change BPA 100/105 driver to use USB anchors
With the new support for USB anchors the driver can become more
simpler and also cleaner. This patch switches to the usage of USB
anchors for all URBs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:43 -07:00
Marcel Holtmann
a9de924806 [Bluetooth] Switch from OGF+OCF to using only opcodes
The Bluetooth HCI commands are divided into logical OGF groups for
easier identification of their purposes. While this still makes sense
for the written specification, its makes the code only more complex
and harder to read. So instead of using separate OGF and OCF values
to identify the commands, use a common 16-bit opcode that combines
both values. As a side effect this also reduces the complexity of
OGF and OCF calculations during command header parsing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-10-22 02:59:40 -07:00
Marcel Holtmann
26a4a06e7f [Bluetooth] Add missing stat.byte_rx counter modification
With the support for hci_recv_fragment() the call to increase the
stat.byte_rx counter got accidentally removed. This patch fixes it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-09-09 08:39:27 +02:00
Robert P. J. Day
924f0e4a06 [Bluetooth] Remove the redundant non-seekable llseek method
Remove the llseek method given that the open method already calls
nonseekable_open().

Signed-off-by: Robert P. J. Day <rpjday@mindspring.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-07-11 06:53:45 +02:00
Marcel Holtmann
babf4d42d0 [Bluetooth] Use hci_recv_fragment() within HCI USB driver
This patch modifies the HCI USB driver to use the new helper function
for reassembling HCI data packets and events.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-07-11 06:42:35 +02:00
Marcel Holtmann
fd184ab428 [Bluetooth] Always send HCI_Reset for Broadcom devices
In case of Broadcom based Bluetooth devices, it is safe to always
send HCI_Reset as first command. This gives the advantage that
all HID Proxy versions will automatically work and don't need any
additional quirks anymore.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-05-24 14:26:15 +02:00
Marcel Holtmann
c33be3c362 [Bluetooth] Fix unintentional fall-through in HCI line discipline
A trivial fix to (what looks like) an unintentional fall-through in the
HCI line discipline.

Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-05-10 23:45:06 -07:00
Marcel Holtmann
22ad42033b [Bluetooth] Fix NULL pointer dereference in HCI line discipline
Normally a serial Bluetooth device is opened, TIOSETD'ed to N_HCI line
discipline, HCIUARTSETPROTO'ed and finally closed. In case the device
fails to HCIUARTSETPROTO, closing it produces a NULL pointer dereference.

Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-05-10 23:45:05 -07:00
Marcel Holtmann
d215874460 [Bluetooth] Add HCIUARTGETDEVICE support for HCI line discipline
Adding HCIUARTGETDEVICE makes it possible to get the HCI device number
that is attached to a given serial device. This is required during the
initialization process of some Bluetooth chips.

Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-05-10 23:45:04 -07:00
Marcel Holtmann
7bb078cba9 [Bluetooth] Correct SCO buffer for another Broadcom based dongle
The SCO buffer size values for Bluetooth chips from Broadcom are wrong
and the USB Bluetooth driver has to set a quirk to correct these SCO
buffer size values.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2007-05-05 00:36:22 +02:00
Marcel Holtmann
c51bd3d3d8 [Bluetooth] Add support for Targus ACB10US USB dongle
This patch adds the vendor and product id of the Targus ACB10US
dongle and sets a flag to send HCI_Reset as the first command.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org
2007-05-05 00:36:17 +02:00
Arnaldo Carvalho de Melo
d626f62b11 [SK_BUFF]: Introduce skb_copy_from_linear_data{_offset}
To clearly state the intent of copying from linear sk_buffs, _offset being a
overly long variant but interesting for the sake of saving some bytes.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2007-04-25 22:28:23 -07:00
Arnaldo Carvalho de Melo
2a123b86e2 [BLUETOOTH]: Introduce skb->data accessor methods for hci_{acl,event,sco}_hdr
For consistency with other skb data accessors, reducing the number of direct
accesses to skb->data.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2007-04-25 22:28:21 -07:00