1. 10 Jan, 2013 3 commits
    • Gustavo Padovan's avatar
      Bluetooth: Check if the hci connection exists in SCO shutdown · b7e98b51
      Gustavo Padovan authored
      Checking only for sco_conn seems to not be enough and lead to NULL
      dereferences in the code, check for hcon instead.
      
      <1>[11340.226404] BUG: unable to handle kernel NULL pointer dereference at
      0000000
      8
      <4>[11340.226619] EIP is at __sco_sock_close+0xe8/0x1a0
      <4>[11340.226629] EAX: f063a740 EBX: 00000000 ECX: f58f4544 EDX: 00000000
      <4>[11340.226640] ESI: dec83e00 EDI: 5f9a081f EBP: e0fdff38 ESP: e0fdff1c
      <0>[11340.226674] Stack:
      <4>[11340.226682]  c184db87 c1251028 dec83e00 e0fdff38 c1754aef dec83e00
      00000000
      e0fdff5c
      <4>[11340.226718]  c184f587 e0fdff64 e0fdff68 5f9a081f e0fdff5c c1751852
      d7813800
      62262f10
      <4>[11340.226752]  e0fdff70 c1753c00 00000000 00000001 0000000d e0fdffac
      c175425c
      00000041
      <0>[11340.226793] Call Trace:
      <4>[11340.226813]  [<c184db87>] ? sco_sock_clear_timer+0x27/0x60
      <4>[11340.226831]  [<c1251028>] ? local_bh_enable+0x68/0xd0
      <4>[11340.226846]  [<c1754aef>] ? lock_sock_nested+0x4f/0x60
      <4>[11340.226862]  [<c184f587>] sco_sock_shutdown+0x67/0xb0
      <4>[11340.226879]  [<c1751852>] ? sockfd_lookup_light+0x22/0x80
      <4>[11340.226897]  [<c1753c00>] sys_shutdown+0x30/0x60
      <4>[11340.226912]  [<c175425c>] sys_socketcall+0x1dc/0x2a0
      <4>[11340.226929]  [<c149ba78>] ? trace_hardirqs_on_thunk+0xc/0x10
      <4>[11340.226944]  [<c18860f1>] syscall_call+0x7/0xb
      <4>[11340.226960]  [<c1880000>] ? restore_cur+0x5e/0xd7
      <0>[11340.226969] Code: <f0> ff 4b 08 0f 94 c0 84 c0 74 20 80 7b 19 01 74
      2f b8 0a 00 00
      Reported-by: default avatarChuansheng Liu <chuansheng.liu@intel.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      b7e98b51
    • Jaganath Kanakkassery's avatar
      Bluetooth: Fix authentication if acl data comes before remote feature evt · 7b064eda
      Jaganath Kanakkassery authored
      If remote device sends l2cap info request before read_remote_ext_feature
      completes then mgmt_connected will be sent in hci_acldata_packet() and
      remote name request wont be sent and eventually authentication wont happen
      
      Hcidump log of the issue
      
      < HCI Command: Create Connection (0x01|0x0005) plen 13
          bdaddr BC:85:1F:74:7F:29 ptype 0xcc18 rswitch 0x01 clkoffset 0x4bf7 (valid)
          Packet type: DM1 DM3 DM5 DH1 DH3 DH5
      > HCI Event: Command Status (0x0f) plen 4
          Create Connection (0x01|0x0005) status 0x00 ncmd 1
      > HCI Event: Connect Complete (0x03) plen 11
          status 0x00 handle 12 bdaddr BC:85:1F:74:7F:29 type ACL encrypt 0x00
      < HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
          handle 12
      > HCI Event: Command Status (0x0f) plen 4
          Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1
      > HCI Event: Read Remote Supported Features (0x0b) plen 11
          status 0x00 handle 12
          Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
      > HCI Event: Max Slots Change (0x1b) plen 3
          handle 12 slots 5
      < HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
          handle 12 page 1
      > HCI Event: Command Status (0x0f) plen 4
          Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
      > ACL data: handle 12 flags 0x02 dlen 10
          L2CAP(s): Info req: type 2
      < ACL data: handle 12 flags 0x00 dlen 16
          L2CAP(s): Info rsp: type 2 result 0
            Extended feature mask 0x00b8
              Enhanced Retransmission mode
              Streaming mode
              FCS Option
              Fixed Channels
      > HCI Event: Read Remote Extended Features (0x23) plen 13
          status 0x00 handle 12 page 1 max 1
          Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
      > ACL data: handle 12 flags 0x02 dlen 10
          L2CAP(s): Info req: type 3
      < ACL data: handle 12 flags 0x00 dlen 20
          L2CAP(s): Info rsp: type 3 result 0
            Fixed channel list 0x00000002
              L2CAP Signalling Channel
      > HCI Event: Number of Completed Packets (0x13) plen 5
          handle 12 packets 2
      
      This patch moves sending mgmt_connected from hci_acldata_packet() to
      l2cap_connect_req() since this code is to handle the scenario remote
      device sends l2cap connect req too fast
      Signed-off-by: default avatarJaganath Kanakkassery <jaganath.k@samsung.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      7b064eda
    • Sergio Cambra's avatar
      Bluetooth device 04ca:3008 should use ath3k · f4d6f7dc
      Sergio Cambra authored
      Output of /sys/kernel/debug/usb/devices
      T:  Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  6 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04ca ProdID=3008 Rev= 0.02
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarSergio Cambra <sergio@programatica.es>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      f4d6f7dc
  2. 09 Jan, 2013 6 commits
    • Anderson Lizardo's avatar
      Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() · 0a9ab9bd
      Anderson Lizardo authored
      The length parameter should be sizeof(req->name) - 1 because there is no
      guarantee that string provided by userspace will contain the trailing
      '\0'.
      
      Can be easily reproduced by manually setting req->name to 128 non-zero
      bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
      input subsystem:
      
      $ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
      AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af
      
      ("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
      field in struct hid_device due to overflow.)
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAnderson Lizardo <anderson.lizardo@openbossa.org>
      Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      0a9ab9bd
    • AceLan Kao's avatar
      Bluetooth: Add support for Foxconn / Hon Hai [0489:e056] · 2582d529
      AceLan Kao authored
      Add support for the AR9462 chip
      
      T: Bus=01 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
      D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
      P: Vendor=0489 ProdID=e056 Rev=00.01
      C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      2582d529
    • AceLan Kao's avatar
      Bluetooth: Add support for Foxconn / Hon Hai [0489:e04e] · 3a61eda8
      AceLan Kao authored
      Add support for the AR9462 chip
      
      T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0489 ProdID=e04e Rev=00.02
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      3a61eda8
    • Daniel Schaal's avatar
      Bluetooth: Add support for GC-WB300D PCIe [04ca:3006] to ath3k. · 2c262b2a
      Daniel Schaal authored
      T:  Bus=02 Lev=02 Prnt=02 Port=06 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04ca ProdID=3006 Rev= 0.02
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarDaniel Schaal <farbing@web.de>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      2c262b2a
    • AceLan Kao's avatar
      Bluetooth: Add support for IMC Networks [13d3:3393] · eed307e2
      AceLan Kao authored
      Add support for the AR9462 chip
      
      T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=13d3 ProdID=3393 Rev=00.01
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      eed307e2
    • Szymon Janc's avatar
      Bluetooth: Fix sending HCI commands after reset · dbccd791
      Szymon Janc authored
      After sending reset command wait for its command complete event before
      sending next command. Some chips sends CC event for command received
      before reset if reset was send before chip replied with CC.
      
      This is also required by specification that host shall not send
      additional HCI commands before receiving CC for reset.
      
      < HCI Command: Reset (0x03|0x0003) plen 0                              [hci0] 18.404612
      > HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.405850
            Write Extended Inquiry Response (0x03|0x0052) ncmd 1
              Status: Success (0x00)
      < HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.406079
      > HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.407864
            Reset (0x03|0x0003) ncmd 1
              Status: Success (0x00)
      < HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.408062
      > HCI Event: Command Complete (0x0e) plen 12                           [hci0] 18.408835
      Signed-off-by: default avatarSzymon Janc <szymon.janc@tieto.com>
      Cc: stable@vger.kernel.org
      Acked-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      dbccd791
  3. 07 Jan, 2013 4 commits
  4. 04 Jan, 2013 6 commits
  5. 03 Jan, 2013 10 commits
  6. 02 Jan, 2013 11 commits