linux-next: manual merge of the bluetooth tree with the origin tree

linux-next: manual merge of the bluetooth tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 5920 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  c28d2bff70444 ("Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short")

from the origin tree and commit:

  19ba9c64840d4 ("Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/l2cap_core.c
index ad98db9632fd2,475fdf1908cb8..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -442,7 -442,7 +442,7 @@@ struct l2cap_chan *l2cap_chan_create(vo
  {
  	struct l2cap_chan *chan;
  
 -	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 +	chan = kzalloc_obj(*chan, GFP_ATOMIC);
  	if (!chan)
  		return NULL;
  
@@@ -1678,17 -1678,15 +1678,15 @@@ static void l2cap_info_timeout(struct w
  
  int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
  {
- 	struct hci_dev *hdev = conn->hcon->hdev;
  	int ret;
  
  	/* We need to check whether l2cap_conn is registered. If it is not, we
- 	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
- 	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
- 	 * relies on the parent hci_conn object to be locked. This itself relies
- 	 * on the hci_dev object to be locked. So we must lock the hci device
- 	 * here, too. */
+ 	 * must not register the l2cap_user. l2cap_conn_del() unregisters
+ 	 * l2cap_conn objects under conn->lock, and we use the same lock here
+ 	 * to protect access to conn->users and conn->hchan.
+ 	 */
  
- 	hci_dev_lock(hdev);
+ 	mutex_lock(&conn->lock);
  
  	if (!list_empty(&user->list)) {
  		ret = -EINVAL;
@@@ -1709,16 -1707,14 +1707,14 @@@
  	ret = 0;
  
  out_unlock:
- 	hci_dev_unlock(hdev);
+ 	mutex_unlock(&conn->lock);
  	return ret;
  }
  EXPORT_SYMBOL(l2cap_register_user);
  
  void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
  {
- 	struct hci_dev *hdev = conn->hcon->hdev;
- 
- 	hci_dev_lock(hdev);
+ 	mutex_lock(&conn->lock);
  
  	if (list_empty(&user->list))
  		goto out_unlock;
@@@ -1727,7 -1723,7 +1723,7 @@@
  	user->remove(conn, user);
  
  out_unlock:
- 	hci_dev_unlock(hdev);
+ 	mutex_unlock(&conn->lock);
  }
  EXPORT_SYMBOL(l2cap_unregister_user);
  
@@@ -4616,7 -4612,8 +4612,8 @@@ static inline int l2cap_information_rsp
  
  	switch (type) {
  	case L2CAP_IT_FEAT_MASK:
- 		conn->feat_mask = get_unaligned_le32(rsp->data);
+ 		if (cmd_len >= sizeof(*rsp) + sizeof(u32))
+ 			conn->feat_mask = get_unaligned_le32(rsp->data);
  
  		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
  			struct l2cap_info_req req;
@@@ -4635,7 -4632,8 +4632,8 @@@
  		break;
  
  	case L2CAP_IT_FIXED_CHAN:
- 		conn->remote_fixed_chan = rsp->data[0];
+ 		if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0]))
+ 			conn->remote_fixed_chan = rsp->data[0];
  		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
  		conn->info_ident = 0;
  
@@@ -5059,7 -5057,7 +5057,7 @@@ static inline int l2cap_ecred_conn_req(
  	u16 mtu, mps;
  	__le16 psm;
  	u8 result, rsp_len = 0;
- 	int i, num_scid;
+ 	int i, num_scid = 0;
  	bool defer = false;
  
  	if (!enable_ecred)
@@@ -5072,6 -5070,14 +5070,14 @@@
  		goto response;
  	}
  
+ 	/* Check if there are no pending channels with the same ident */
+ 	__l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer,
+ 			     &num_scid);
+ 	if (num_scid) {
+ 		result = L2CAP_CR_LE_INVALID_PARAMS;
+ 		goto response;
+ 	}
+ 
  	cmd_len -= sizeof(*req);
  	num_scid = cmd_len / sizeof(u16);
  
@@@ -5424,7 -5430,7 +5430,7 @@@ static inline int l2cap_ecred_reconf_rs
  					 u8 *data)
  {
  	struct l2cap_chan *chan, *tmp;
- 	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
+ 	struct l2cap_ecred_reconf_rsp *rsp = (void *)data;
  	u16 result;
  
  	if (cmd_len < sizeof(*rsp))
@@@ -5432,7 -5438,7 +5438,7 @@@
  
  	result = __le16_to_cpu(rsp->result);
  
- 	BT_DBG("result 0x%4.4x", rsp->result);
+ 	BT_DBG("result 0x%4.4x", result);
  
  	if (!result)
  		return 0;
@@@ -6662,8 -6668,17 +6668,17 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
- 	if (chan->imtu < skb->len) {
- 		BT_ERR("Too big LE L2CAP PDU");
+ 	if (skb->len > chan->imtu) {
+ 		BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len,
+ 		       chan->imtu);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
  		return -ENOBUFS;
  	}
  
@@@ -6689,7 -6704,9 +6704,9 @@@
  		       sdu_len, skb->len, chan->imtu);
  
  		if (sdu_len > chan->imtu) {
- 			BT_ERR("Too big LE L2CAP SDU length received");
+ 			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
+ 			       skb->len, sdu_len);
+ 			l2cap_send_disconn_req(chan, ECONNRESET);
  			err = -EMSGSIZE;
  			goto failed;
  		}
@@@ -6725,6 -6742,7 +6742,7 @@@
  
  	if (chan->sdu->len + skb->len > chan->sdu_len) {
  		BT_ERR("Too much LE L2CAP data received");
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
  		err = -EINVAL;
  		goto failed;
  	}
@@@ -6947,7 -6965,7 +6965,7 @@@ static struct l2cap_conn *l2cap_conn_ad
  	if (!hchan)
  		return NULL;
  
 -	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 +	conn = kzalloc_obj(*conn);
  	if (!conn) {
  		hci_chan_del(hchan);
  		return NULL;

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 840 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/mgmt.c

between commit:

  6bbd0d3f0c23f ("Bluetooth: hci_sync: fix set_local_name race condition")

from the origin tree and commit:

  3b3eb857d5ab6 ("Bluetooth: MGMT: Fix possible UAFs")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 50634ef5c8b70,ee7068fb9fb59..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 860 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/mgmt.c

between commit:

  6bbd0d3f0c23f ("Bluetooth: hci_sync: fix set_local_name race condition")

from the origin tree and commit:

  c49a788e88e48 ("Bluetooth: hci_sync: fix set_local_name race condition")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 50634ef5c8b70,b9c53810bf06b..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the origin tree

[broonie]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/hci_conn.c

between commit:

  5dc7d23e167e2 ("Bluetooth: hci_conn: Fix possible UAF")

from the origin tree and commit:

  0623067085473 ("Bluetooth: hci_conn: Fix possible UAF")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/hci_conn.c
index 8455ba141ee61,640b951bf40a1..0000000000000
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c