linux-next: manual merge of the bluetooth tree with the net tree

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

Hi all,

Today's linux-next merge of the bluetooth tree got conflicts in:

  net/bluetooth/hci_sysfs.c
  net/bluetooth/hci_core.c
  include/net/bluetooth/hci_core.h

between commit:

  e04480920d1e ("Bluetooth: defer cleanup of resources in hci_unregister_dev()")

from the net tree and commit:

  58ce6d5b271a ("Bluetooth: defer cleanup of resources in hci_unregister_dev()")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc include/net/bluetooth/hci_core.h
index db4312e44d47,a7d06d7da602..000000000000
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
diff --cc net/bluetooth/hci_core.c
index e1a545c8a69f,cb2e9e513907..000000000000
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
diff --cc net/bluetooth/hci_sysfs.c
index b69d88b88d2e,ebf282d1eb2b..000000000000
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c

linux-next: manual merge of the bluetooth tree with the net tree

[broonie]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/mgmt.c

between commit:

  23b72814da1a0 ("Bluetooth: MGMT: Fix Get Device Flags")

from the net tree and commit:

  529d4492aed7c ("Bluetooth: MGMT: Fix Get Device Flags")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 72e6595a71cc0,a92e7e485feba..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c

linux-next: manual merge of the bluetooth tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 833 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/hci_core.c

between commit:

  f1a8f402f13f ("Bluetooth: L2CAP: Fix deadlock")

from the net tree and commits:

  6851d11d389c ("Bluetooth: Fix double free in hci_req_sync_complete")
  7b256038ca7c ("Bluetooth: Fix usage of __hci_cmd_sync_status")

from the bluetooth tree.

I fixed it up (I basically used the latter where they conflicted) and
can carry the fix as necessary. This is now fixed as far as linux-next
is concerned, but any non trivial conflicts should be mentioned to your
upstream maintainer when your tree is submitted for merging.  You may
also want to consider cooperating with the maintainer of the
conflicting tree to minimise any particularly complex conflicts.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1180 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got conflicts in:

  net/bluetooth/mgmt.c
  net/bluetooth/mgmt_util.c
  net/bluetooth/mgmt_util.h

between commit:

  302a1f674c00d ("Bluetooth: MGMT: Fix possible UAFs")

from the net tree and commit:

  3b3eb857d5ab6 ("Bluetooth: MGMT: Fix possible UAFs")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 225140fcb3d6c,ee7068fb9fb59..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
diff --cc net/bluetooth/mgmt_util.c
index aa7b5585cb268,258c22d38809a..0000000000000
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
diff --cc net/bluetooth/mgmt_util.h
index bcba8c9d89528,e94738d992900..0000000000000
--- a/net/bluetooth/mgmt_util.h
+++ b/net/bluetooth/mgmt_util.h

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 7535 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  drivers/bluetooth/hci_qca.c

between commit:

  5c4e9a8b18457 ("Bluetooth: hci_qca: Cleanup on all setup failures")

from the net tree and commits:

  facc2350b0df6 ("Bluetooth: hci_qca: Cleanup on all setup failures")
  88b5c728a785c ("Bluetooth: hci_qca: Fix confusing shutdown() and power_off() naming")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/bluetooth/hci_qca.c
index bb9f002aa85e9,6928820380b80..0000000000000
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@@ -236,8 -236,7 +236,7 @@@ struct qca_serdev 
  
  static int qca_regulator_enable(struct qca_serdev *qcadev);
  static void qca_regulator_disable(struct qca_serdev *qcadev);
- static void qca_power_shutdown(struct hci_uart *hu);
- static int qca_power_off(struct hci_dev *hdev);
+ static void qca_power_off(struct hci_uart *hu);
  static void qca_controller_memdump(struct work_struct *work);
  static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb);
  
@@@ -585,7 -584,7 +584,7 @@@ static int qca_open(struct hci_uart *hu
  	if (!hci_uart_has_flow_control(hu))
  		return -EOPNOTSUPP;
  
 -	qca = kzalloc(sizeof(*qca), GFP_KERNEL);
 +	qca = kzalloc_obj(*qca);
  	if (!qca)
  		return -ENOMEM;
  
@@@ -723,6 -722,10 +722,10 @@@ static int qca_close(struct hci_uart *h
  
  	BT_DBG("hu %p qca close", hu);
  
+ 	/* BT core skips qca_hci_shutdown() which calls qca_power_off() on rmmod */
+ 	if (!test_bit(QCA_BT_OFF, &qca->flags))
+ 		qca_power_off(hu);
+ 
  	serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
  
  	skb_queue_purge(&qca->tx_wait_q);
@@@ -1057,7 -1060,7 +1060,7 @@@ static void qca_controller_memdump(stru
  		}
  
  		if (!qca_memdump) {
 -			qca_memdump = kzalloc(sizeof(*qca_memdump), GFP_ATOMIC);
 +			qca_memdump = kzalloc_obj(*qca_memdump, GFP_ATOMIC);
  			if (!qca_memdump) {
  				mutex_unlock(&qca->hci_memdump_lock);
  				return;
@@@ -1850,6 -1853,7 +1853,7 @@@ static int qca_power_on(struct hci_dev 
  		return 0;
  
  	switch (soc_type) {
+ 	case QCA_QCA6390:
  	case QCA_WCN3950:
  	case QCA_WCN3988:
  	case QCA_WCN3990:
@@@ -1858,7 -1862,6 +1862,6 @@@
  	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_QCA6390:
  		ret = qca_regulator_init(hu);
  		break;
  
@@@ -2047,7 -2050,7 +2050,7 @@@ retry
  
  out:
  	if (ret) {
- 		qca_power_shutdown(hu);
+ 		qca_power_off(hu);
  
  		if (retries < MAX_INIT_RETRIES) {
  			bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
@@@ -2096,6 -2099,18 +2099,18 @@@ static const struct hci_uart_proto qca_
  	.dequeue	= qca_dequeue,
  };
  
+ static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
+ 	.soc_type = QCA_QCA2066,
+ 	.num_vregs = 0,
+ 	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES |
+ 			QCA_CAP_HFP_HW_OFFLOAD,
+ };
+ 
+ static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
+ 	.soc_type = QCA_QCA6390,
+ 	.num_vregs = 0,
+ };
+ 
  static const struct qca_device_data qca_soc_data_wcn3950 __maybe_unused = {
  	.soc_type = QCA_WCN3950,
  	.vregs = (struct qca_vreg []) {
@@@ -2152,18 -2167,6 +2167,6 @@@ static const struct qca_device_data qca
  	.num_vregs = 4,
  };
  
- static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
- 	.soc_type = QCA_QCA2066,
- 	.num_vregs = 0,
- 	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES |
- 			QCA_CAP_HFP_HW_OFFLOAD,
- };
- 
- static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
- 	.soc_type = QCA_QCA6390,
- 	.num_vregs = 0,
- };
- 
  static const struct qca_device_data qca_soc_data_wcn6750 __maybe_unused = {
  	.soc_type = QCA_WCN6750,
  	.vregs = (struct qca_vreg []) {
@@@ -2211,7 -2214,7 +2214,7 @@@ static const struct qca_device_data qca
  			QCA_CAP_HFP_HW_OFFLOAD,
  };
  
- static void qca_power_shutdown(struct hci_uart *hu)
+ static void qca_power_off(struct hci_uart *hu)
  {
  	struct qca_serdev *qcadev;
  	struct qca_data *qca = hu->priv;
@@@ -2261,7 -2264,7 +2264,7 @@@
  		qca_regulator_disable(qcadev);
  		if (qcadev->sw_ctrl) {
  			sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
- 			bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
+ 			BT_DBG("SW_CTRL is %d", sw_ctrl_state);
  		}
  		break;
  
@@@ -2272,7 -2275,7 +2275,7 @@@
  	set_bit(QCA_BT_OFF, &qca->flags);
  }
  
- static int qca_power_off(struct hci_dev *hdev)
+ static int qca_hci_shutdown(struct hci_dev *hdev)
  {
  	struct hci_uart *hu = hci_get_drvdata(hdev);
  	struct qca_data *qca = hu->priv;
@@@ -2291,7 -2294,7 +2294,7 @@@
  		usleep_range(8000, 10000);
  	}
  
- 	qca_power_shutdown(hu);
+ 	qca_power_off(hu);
  	return 0;
  }
  
@@@ -2402,6 -2405,7 +2405,7 @@@ static int qca_serdev_probe(struct serd
  		qcadev->btsoc_type = QCA_ROME;
  
  	switch (qcadev->btsoc_type) {
+ 	case QCA_QCA6390:
  	case QCA_WCN3950:
  	case QCA_WCN3988:
  	case QCA_WCN3990:
@@@ -2410,7 -2414,6 +2414,6 @@@
  	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_QCA6390:
  		qcadev->bt_power = devm_kzalloc(&serdev->dev,
  						sizeof(struct qca_power),
  						GFP_KERNEL);
@@@ -2422,9 -2425,9 +2425,9 @@@
  	}
  
  	switch (qcadev->btsoc_type) {
+ 	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_WCN6750:
  		if (!device_property_present(&serdev->dev, "enable-gpios")) {
  			/*
  			 * Backward compatibility with old DT sources. If the
@@@ -2530,7 -2533,7 +2533,7 @@@
  
  	if (power_ctrl_enabled) {
  		hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
- 		hdev->shutdown = qca_power_off;
+ 		hdev->shutdown = qca_hci_shutdown;
  	}
  
  	if (data) {
@@@ -2565,7 -2568,7 +2568,7 @@@ static void qca_serdev_remove(struct se
  	case QCA_WCN6855:
  	case QCA_WCN7850:
  		if (power->vregs_on)
- 			qca_power_shutdown(&qcadev->serdev_hu);
+ 			qca_power_off(&qcadev->serdev_hu);
  		break;
  	default:
  		break;
@@@ -2574,10 -2577,11 +2577,10 @@@
  	hci_uart_unregister_device(&qcadev->serdev_hu);
  }
  
 -static void qca_serdev_shutdown(struct device *dev)
 +static void qca_serdev_shutdown(struct serdev_device *serdev)
  {
  	int ret;
  	int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
 -	struct serdev_device *serdev = to_serdev_device(dev);
  	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
  	struct hci_uart *hu = &qcadev->serdev_hu;
  	struct hci_dev *hdev = hu->hdev;
@@@ -2799,11 -2803,11 +2802,11 @@@ static void hciqca_coredump(struct devi
  static struct serdev_device_driver qca_serdev_driver = {
  	.probe = qca_serdev_probe,
  	.remove = qca_serdev_remove,
 +	.shutdown = qca_serdev_shutdown,
  	.driver = {
  		.name = "hci_uart_qca",
  		.of_match_table = of_match_ptr(qca_bluetooth_of_match),
  		.acpi_match_table = ACPI_PTR(qca_bluetooth_acpi_match),
 -		.shutdown = qca_serdev_shutdown,
  		.pm = &qca_pm_ops,
  #ifdef CONFIG_DEV_COREDUMP
  		.coredump = hciqca_coredump,

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 2004 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  b65e87418bb37 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  cb75c9a0505b8 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

I note that the bluetooth tree does not seem to have merged up v7.0-rcX
at all.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,475fdf1908cb8..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -442,7 -442,7 +442,7 @@@ struct l2cap_chan *l2cap_chan_create(vo
  {
  	struct l2cap_chan *chan;
  
 -	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 +	chan = kzalloc_obj(*chan, GFP_ATOMIC);
  	if (!chan)
  		return NULL;
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6958,7 -6965,7 +6965,7 @@@ static struct l2cap_conn *l2cap_conn_ad
  	if (!hchan)
  		return NULL;
  
 -	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 +	conn = kzalloc_obj(*conn);
  	if (!conn) {
  		hci_chan_del(hchan);
  		return NULL;

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 2623 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  fa768fce4aae7 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  ef20d3012d9e4 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")
  013598897448b ("Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,ead51dc0f3f12..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -5081,14 -5081,14 +5081,14 @@@ static inline int l2cap_ecred_conn_req(
  	cmd_len -= sizeof(*req);
  	num_scid = cmd_len / sizeof(u16);
  
- 	/* Always respond with the same number of scids as in the request */
- 	rsp_len = cmd_len;
- 
  	if (num_scid > L2CAP_ECRED_MAX_CID) {
  		result = L2CAP_CR_LE_INVALID_PARAMS;
  		goto response;
  	}
  
+ 	/* Always respond with the same number of scids as in the request */
+ 	rsp_len = cmd_len;
+ 
  	mtu  = __le16_to_cpu(req->mtu);
  	mps  = __le16_to_cpu(req->mps);
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6690,6 -6697,11 +6697,11 @@@
  	if (!chan->sdu) {
  		u16 sdu_len;
  
+ 		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
+ 			err = -EINVAL;
+ 			goto failed;
+ 		}
+ 
  		sdu_len = get_unaligned_le16(skb->data);
  		skb_pull(skb, L2CAP_SDULEN_SIZE);
  
@@@ -6698,7 -6710,7 +6710,7 @@@
  
  		if (sdu_len > chan->imtu) {
  			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
- 			       skb->len, sdu_len);
+ 			       sdu_len, chan->imtu);
  			l2cap_send_disconn_req(chan, ECONNRESET);
  			err = -EMSGSIZE;
  			goto failed;

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]