1. 23 Mar, 2010 3 commits
  2. 22 Mar, 2010 17 commits
  3. 21 Mar, 2010 3 commits
    • Andrei Emeltchenko's avatar
      Bluetooth: Fix kernel crash on L2CAP stress tests · c2c77ec8
      Andrei Emeltchenko authored
      Added very simple check that req buffer has enough space to
      fit configuration parameters. Shall be enough to reject packets
      with configuration size more than req buffer.
      
      Crash trace below
      
      [ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
      [ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
      ...
      [ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
      [ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
      ...
      [ 6070.030303] Backtrace:
      [ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
      [<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
      [ 6070.043823]  r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
      [ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
      [<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
      [ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
      [<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth])
      [ 6070.072631]  r6:dc647700 r5:00000001 r4:df2ab740
      [ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from
      [<c006b9fc>] (tasklet_action+0x78/0xd8)
      [ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>]
      Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@nokia.com>
      Acked-by: default avatarGustavo F. Padovan <gustavo@padovan.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      c2c77ec8
    • Marcel Holtmann's avatar
      Bluetooth: Convert debug files to actually use debugfs instead of sysfs · aef7d97c
      Marcel Holtmann authored
      Some of the debug files ended up wrongly in sysfs, because at that point
      of time, debugfs didn't exist. Convert these files to use debugfs and
      also seq_file. This patch converts all of these files at once and then
      removes the exported symbol for the Bluetooth sysfs class.
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      aef7d97c
    • Marcel Holtmann's avatar
      Bluetooth: Fix potential bad memory access with sysfs files · 101545f6
      Marcel Holtmann authored
      When creating a high number of Bluetooth sockets (L2CAP, SCO
      and RFCOMM) it is possible to scribble repeatedly on arbitrary
      pages of memory. Ensure that the content of these sysfs files is
      always less than one page. Even if this means truncating. The
      files in question are scheduled to be moved over to debugfs in
      the future anyway.
      
      Based on initial patches from Neil Brown and Linus Torvalds
      Reported-by: default avatarNeil Brown <neilb@suse.de>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      101545f6
  4. 20 Mar, 2010 17 commits