Skip to content

Commit 53729eb

Browse files
davem330davem330
committed
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Johan Hedberg says: ==================== pull request: bluetooth 2016-01-30 Here's a set of important Bluetooth fixes for the 4.5 kernel: - Two fixes to 6LoWPAN code (one fixing a potential crash) - Fix LE pairing with devices using both public and random addresses - Fix allocation of dynamic LE PSM values - Fix missing COMPATIBLE_IOCTL for UART line discipline Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents 99b4dd9 + cff10ce commit 53729eb

File tree

7 files changed

+51
-35
lines changed

7 files changed

+51
-35
lines changed

‎fs/compat_ioctl.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1261,6 +1261,9 @@ COMPATIBLE_IOCTL(HCIUNBLOCKADDR)
12611261
COMPATIBLE_IOCTL(HCIINQUIRY)
12621262
COMPATIBLE_IOCTL(HCIUARTSETPROTO)
12631263
COMPATIBLE_IOCTL(HCIUARTGETPROTO)
1264+
COMPATIBLE_IOCTL(HCIUARTGETDEVICE)
1265+
COMPATIBLE_IOCTL(HCIUARTSETFLAGS)
1266+
COMPATIBLE_IOCTL(HCIUARTGETFLAGS)
12641267
COMPATIBLE_IOCTL(RFCOMMCREATEDEV)
12651268
COMPATIBLE_IOCTL(RFCOMMRELEASEDEV)
12661269
COMPATIBLE_IOCTL(RFCOMMGETDEVLIST)

‎include/net/bluetooth/l2cap.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,12 @@ struct l2cap_conn_rsp {
252252
#define L2CAP_PSM_3DSP 0x0021
253253
#define L2CAP_PSM_IPSP 0x0023 /* 6LoWPAN */
254254

255+
#define L2CAP_PSM_DYN_START 0x1001
256+
#define L2CAP_PSM_DYN_END 0xffff
257+
#define L2CAP_PSM_AUTO_END 0x10ff
258+
#define L2CAP_PSM_LE_DYN_START 0x0080
259+
#define L2CAP_PSM_LE_DYN_END 0x00ff
260+
255261
/* channel identifier */
256262
#define L2CAP_CID_SIGNALING 0x0001
257263
#define L2CAP_CID_CONN_LESS 0x0002

‎net/bluetooth/6lowpan.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
307307

308308
/* check that it's our buffer */
309309
if (lowpan_is_ipv6(*skb_network_header(skb))) {
310+
/* Pull off the 1-byte of 6lowpan header. */
311+
skb_pull(skb, 1);
312+
310313
/* Copy the packet so that the IPv6 header is
311314
* properly aligned.
312315
*/
@@ -317,6 +320,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
317320

318321
local_skb->protocol = htons(ETH_P_IPV6);
319322
local_skb->pkt_type = PACKET_HOST;
323+
local_skb->dev = dev;
320324

321325
skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
322326

@@ -335,6 +339,8 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
335339
if (!local_skb)
336340
goto drop;
337341

342+
local_skb->dev = dev;
343+
338344
ret = iphc_decompress(local_skb, dev, chan);
339345
if (ret < 0) {
340346
kfree_skb(local_skb);
@@ -343,7 +349,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
343349

344350
local_skb->protocol = htons(ETH_P_IPV6);
345351
local_skb->pkt_type = PACKET_HOST;
346-
local_skb->dev = dev;
347352

348353
if (give_skb_to_upper(local_skb, dev)
349354
!= NET_RX_SUCCESS) {

‎net/bluetooth/hci_request.c

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -688,21 +688,29 @@ static u8 update_white_list(struct hci_request *req)
688688
* command to remove it from the controller.
689689
*/
690690
list_for_each_entry(b, &hdev->le_white_list, list) {
691-
struct hci_cp_le_del_from_white_list cp;
691+
/* If the device is neither in pend_le_conns nor
692+
* pend_le_reports then remove it from the whitelist.
693+
*/
694+
if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
695+
&b->bdaddr, b->bdaddr_type) &&
696+
!hci_pend_le_action_lookup(&hdev->pend_le_reports,
697+
&b->bdaddr, b->bdaddr_type)) {
698+
struct hci_cp_le_del_from_white_list cp;
699+
700+
cp.bdaddr_type = b->bdaddr_type;
701+
bacpy(&cp.bdaddr, &b->bdaddr);
692702

693-
if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
694-
&b->bdaddr, b->bdaddr_type) ||
695-
hci_pend_le_action_lookup(&hdev->pend_le_reports,
696-
&b->bdaddr, b->bdaddr_type)) {
697-
white_list_entries++;
703+
hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
704+
sizeof(cp), &cp);
698705
continue;
699706
}
700707

701-
cp.bdaddr_type = b->bdaddr_type;
702-
bacpy(&cp.bdaddr, &b->bdaddr);
708+
if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
709+
/* White list can not be used with RPAs */
710+
return 0x00;
711+
}
703712

704-
hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
705-
sizeof(cp), &cp);
713+
white_list_entries++;
706714
}
707715

708716
/* Since all no longer valid white list entries have been

‎net/bluetooth/l2cap_core.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,10 +197,20 @@ int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
197197
chan->sport = psm;
198198
err = 0;
199199
} else {
200-
u16 p;
200+
u16 p, start, end, incr;
201+
202+
if (chan->src_type == BDADDR_BREDR) {
203+
start = L2CAP_PSM_DYN_START;
204+
end = L2CAP_PSM_AUTO_END;
205+
incr = 2;
206+
} else {
207+
start = L2CAP_PSM_LE_DYN_START;
208+
end = L2CAP_PSM_LE_DYN_END;
209+
incr = 1;
210+
}
201211

202212
err = -EINVAL;
203-
for (p = 0x1001; p < 0x1100; p += 2)
213+
for (p = start; p <= end; p += incr)
204214
if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
205215
chan->psm = cpu_to_le16(p);
206216
chan->sport = cpu_to_le16(p);

‎net/bluetooth/l2cap_sock.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ static int l2cap_validate_bredr_psm(u16 psm)
5858
return -EINVAL;
5959

6060
/* Restrict usage of well-known PSMs */
61-
if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
61+
if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
6262
return -EACCES;
6363

6464
return 0;
@@ -67,11 +67,11 @@ static int l2cap_validate_bredr_psm(u16 psm)
6767
static int l2cap_validate_le_psm(u16 psm)
6868
{
6969
/* Valid LE_PSM ranges are defined only until 0x00ff */
70-
if (psm > 0x00ff)
70+
if (psm > L2CAP_PSM_LE_DYN_END)
7171
return -EINVAL;
7272

7373
/* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74-
if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
74+
if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
7575
return -EACCES;
7676

7777
return 0;
@@ -125,6 +125,9 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
125125
goto done;
126126
}
127127

128+
bacpy(&chan->src, &la.l2_bdaddr);
129+
chan->src_type = la.l2_bdaddr_type;
130+
128131
if (la.l2_cid)
129132
err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
130133
else
@@ -156,9 +159,6 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
156159
break;
157160
}
158161

159-
bacpy(&chan->src, &la.l2_bdaddr);
160-
chan->src_type = la.l2_bdaddr_type;
161-
162162
if (chan->psm && bdaddr_type_is_le(chan->src_type))
163163
chan->mode = L2CAP_MODE_LE_FLOWCTL;
164164

‎net/bluetooth/smp.c

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1072,22 +1072,6 @@ static void smp_notify_keys(struct l2cap_conn *conn)
10721072
hcon->dst_type = smp->remote_irk->addr_type;
10731073
queue_work(hdev->workqueue, &conn->id_addr_update_work);
10741074
}
1075-
1076-
/* When receiving an indentity resolving key for
1077-
* a remote device that does not use a resolvable
1078-
* private address, just remove the key so that
1079-
* it is possible to use the controller white
1080-
* list for scanning.
1081-
*
1082-
* Userspace will have been told to not store
1083-
* this key at this point. So it is safe to
1084-
* just remove it.
1085-
*/
1086-
if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
1087-
list_del_rcu(&smp->remote_irk->list);
1088-
kfree_rcu(smp->remote_irk, rcu);
1089-
smp->remote_irk = NULL;
1090-
}
10911075
}
10921076

10931077
if (smp->csrk) {

0 commit comments

Comments
 (0)