summaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2011-07-11Bluetooth: Start SMP procedureAnderson Briglia
Start SMP procedure for LE connections. This modification intercepts l2cap received frames and call proper SMP functions to start the SMP procedure. By now, no keys are being used. Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Implement the first SMP commandsAnderson Briglia
These simple commands will allow the SMP procedure to be started and terminated with a not supported error. This is the first step toward something useful. Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Don't forget to check for LE_LINKGustavo F. Padovan
Otherwise the wrong error can be returned. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: keep reference if any ERTM timer is enabledGustavo F. Padovan
ERTM use the generic L2CAP timer functions to keep a reference to the channel. This is useful for avoiding crashes. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Make timer functions genericGustavo F. Padovan
We now plan to use l2cap_set_timer and l2cap_clear_timer in ERTM timers. Change-Id: Ie62b01e003f8885ae89c73e2e64195c21cbadddd Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add refcnt to struct l2cap_chanGustavo F. Padovan
struct l2cap_chan has now its own refcnt that is compatible with the socket refcnt, i.e., we won't see sk_refcnt = 0 and chan->refcnt > 0. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add state tracking to struct l2cap_chanGustavo F. Padovan
Now socket state is tracked by struct sock and channel state is tracked by chan->state. At this point both says the same, but this is going to change when we add AMP Support for example. Change-Id: Idbf873f5e8dd94f5b2482ba960c52193d28ce5dd Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: add close() callback to l2cap_chan_opsGustavo F. Padovan
close() calls l2cap_sock_kill() on l2cap_sock.c Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: add recv() callback to l2cap_chan_opsGustavo F. Padovan
This abstracts the call to sock_queue_recv_skb() into l2cap_chan_ops->recv(). Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add l2cap_chan_ops abstractionGustavo F. Padovan
Add an abstraction layer between L2CAP core and its users (only l2cap_sock.c now). The first function implemented is new_connection() that replaces calls to l2cap_sock_alloc() in l2cap_core.c Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Merge l2cap_chan_create() in the l2cap_sock_alloc()Gustavo F. Padovan
As a first step to remove l2cap_sock_alloc() and l2cap_sock_init() from l2cap_core.c Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Kill set but unused variable 'cmd' in cmtp_recv_capimsg()David Miller
Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warningStephen Boyd
Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following warning: In function 'copy_from_user', inlined from 'rfcomm_sock_setsockopt' at net/bluetooth/rfcomm/sock.c:705: arch/x86/include/asm/uaccess_64.h:65: warning: call to 'copy_from_user_overflow' declared with attribute warning: copy_from_user() buffer size is not provably correct presumably due to buf_size being signed causing GCC to fail to see that buf_size can't become negative. Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Fix check for the ERTM local busy stateMat Martineau
Local busy is encoded in a bitfield, but was not masked out correctly. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Restore accidentally-deleted lineMat Martineau
When code was moved from l2cap_core.c to l2cap_sock.c in commit 6de0702b5b93da0ef097aa092b4597fbc024ebba, one line was dropped from the old __l2cap_sock_close() implementation. This sk_state change should still be in l2cap_chan_close(). Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Simplify hci_conn_accept_secure checkWaldemar Rymarkiewicz
If the link key is secure (authenticated or combination 16 digit) the sec_level will be always BT_SECURITY_HIGH. Therefore, instead of checking the link key type simply check the sec_level on the link. Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add BT_POWER L2CAP socket option.Jaikumar Ganesh
Add BT_POWER socket option used to control the power characteristics of the underlying ACL link. When the remote end has put the link in sniff mode and the host stack wants to send data we need need to explicitly exit sniff mode to work well with certain devices (For example, A2DP on Plantronics Voyager 855). However, this causes problems with HID devices. Hence, moving into active mode when sending data, irrespective of who set the sniff mode has been made as a socket option. By default, we will move into active mode. HID devices can set the L2CAP socket option to prevent this from happening. Currently, this has been implemented for L2CAP sockets. This has been tested with incoming and outgoing L2CAP sockets for HID and A2DP. Based on discussions on linux-bluetooth and patches submitted by Andrei Emeltchenko. Signed-off-by: Jaikumar Ganesh <jaikumar@google.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Verify a pin code in pin_code_replyWaldemar Rymarkiewicz
As we cannot relay on a userspace mgmt api implementation we should verify if pin_code_reply in fact contains the secure pin code. If userspace replied with unsecure pincode when secure was required we will send pin_code_neg_reply to the controller. Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Remove a magic numberWaldemar Rymarkiewicz
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: fix sparse & gcc warningsJohannes Berg
sparse complains about a few things that should be static. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Set 'peer_addr_type' in hci_le_connect()Andre Guedes
Set the 'peer_addr_type' field of the LE Create Connection command sent in hci_le_connect(). Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Acked-by: Ville Tervo <ville.tervo@nokia.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Check advertising cache in hci_connect()Andre Guedes
When connecting to a LE device, we need to check the advertising cache in order to know the address type of that device. If its advertising entry is not found, the connection is not established and hci_connect() returns error. Change-Id: I234912abc53b859becbe79625b08bc3b6eacc143 Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Acked-by: Ville Tervo <ville.tervo@nokia.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Remove useless check in hci_connect()Andre Guedes
There is no need to check the connection's state since hci_conn_add() has just created a new connection and its state has been set properly. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Acked-by: Ville Tervo <ville.tervo@nokia.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add 'dst_type' field to struct hci_connAndre Guedes
This patch adds a new field (dst_type) to the struct hci_conn which holds the type of the destination address (bdaddr_t dst). This approach is needed in order to use the struct hci_conn as an abstraction of LE connections in HCI Layer. For non-LE this field is ignored. This patch also set properly the 'dst_type' field after initializing LE hci_conn structures. Change-Id: I1e363bb6de263fdb1fe976a5a16ed5debc9b8c0c Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Refactor hci_auth_complete_evt functionWaldemar Rymarkiewicz
Replace if(conn) with if(!conn) checking to avoid too many nested statements Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Fix auth_complete_evt for legacy unitsWaldemar Rymarkiewicz
Legacy devices don't re-authenticate the link properly if a link key already exists. Thus, don't update sec_level for this case even if hci_auth_complete_evt indicates success. Otherwise the sec_level will not reflect a real security on the link. Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Advertising entries lifetimeAndre Guedes
This patch adds a timer to clear 'adv_entries' after three minutes. After some amount of time, the advertising entries cached during the last LE scan should be considered expired and they should be removed from the advertising cache. It was chosen a three minutes timeout as an initial attempt. This value might change in future. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Clear advertising cache before scanningAndre Guedes
The LE advertising cache should be cleared before performing a LE scanning. This will force the cache to contain only fresh advertising entries. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add Advertising Report Meta Event handlerAndre Guedes
This patch adds a function to handle LE Advertising Report Meta Events. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: LE advertising cacheAndre Guedes
This patch implements the LE advertising cache. It stores sensitive information (bdaddr and bdaddr_type so far) gathered from LE advertising report events. Only advertising entries from connectables devices are added to the cache. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Rename __l2cap_chan_close() to l2cap_chan_close()Gustavo F. Padovan
To make it consistent with the rest of the API. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Remove export of l2cap_chan_clear_timer()Gustavo F. Padovan
The call to l2cap_chan_clear_timer() is not really needed in l2cap_sock.c. This patch also adds a call to l2cap_chan_clear_timer() to the only place in __l2cap_sock_close() that wasn't calling it. It's safe call it there because l2cap_chan_clear_timer() check first for timer_peding(). Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: create channel timer to replace sk_timerGustavo F. Padovan
The new timer does not belong to struct sock, tought it still touch some sock things, but this will be sorted out soon. Change-Id: I55dc122657f3b8e80e76acf8c479e2d5c9889af5 Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Add chan->chan_type struct memberGustavo F. Padovan
chan_type says if our chan is raw(direclty access to HCI), connection less or connection oriented. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Create l2cap_chan_send()Gustavo F. Padovan
This move all the sending logic to l2cap_core.c, but we still have a socket dependence there, struct msghdr. It will be removed in some of the further commits. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Create __l2cap_chan_close()Gustavo F. Padovan
This is actually __l2cap_sock_close() renamed to __l2cap_chan_close(). At a first look it may not make sense, but with the further cleanups that will come it will. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Remove unnecessary use of hci_dev_list_lockJohan Hedberg
The get_connections function has no need to use hci_dev_list_lock. The code was there probably because of a copy-paste mistake. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Kill set but not used variable 'l2cap_sk' in ↵David Miller
rfcomm_sock_getsockopt_old() Change-Id: I33c0404c6dcf1d3e8bc39e8c583f073329add294 Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: fix set but not used warningGustavo F. Padovan
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-11Bluetooth: Allow unsegmented SDU retries on sock_queue_rcv_skb failureRuiyi Zhang
In L2CAP_SDU_UNSEGMENTED case, if sock_queue_rcv_skb returns error, l2cap_ertm_reassembly_sdu should not return 0 so as to insert the skb into BUSY_QUEUE for later retries. Signed-off-by: Ruiyi Zhang <Ruiyi.Zhang@Atheros.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-07-08sctp: ABORT if receive, reassmbly, or reodering queue is not empty while ↵Thomas Graf
closing socket Trigger user ABORT if application closes a socket which has data queued on the socket receive queue or chunks waiting on the reassembly or ordering queue as this would imply data being lost which defeats the point of a graceful shutdown. This behavior is already practiced in TCP. We do not check the input queue because that would mean to parse all chunks on it to look for unacknowledged data which seems too much of an effort. Control chunks or duplicated chunks may also be in the input queue and should not be stopping a graceful shutdown. Signed-off-by: Thomas Graf <tgraf@infradead.org> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-08Merge branch 'for-davem' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2011-07-08XFRM: Fix memory leak in xfrm_state_updateTushar Gohad
Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on the user-supplied SA and forgets to drop the reference when xfrm_state_update() returns 0. This leads to a memory leak as the parameter SA is never freed. This change attempts to fix the leak by calling __xfrm_state_put() when xfrm_state_update() updates a valid SA (err = 0). The parameter SA is added to the gc list when the final reference is dropped by xfrm_add_sa() upon completion. Signed-off-by: Tushar Gohad <tgohad@mvista.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-08Merge branch 'master' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into for-davem
2011-07-07Merge commit 'v3.0-rc6' into android-3.0Dima Zavin
2011-07-07SUNRPC: Fix a race between work-queue and rpc_killall_tasksTrond Myklebust
Since rpc_killall_tasks may modify the rpc_task's tk_action field without any locking, we need to be careful when dereferencing it. Reported-by: Ben Greear <greearb@candelatech.com> Tested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@kernel.org
2011-07-07sctp: Enforce retransmission limit during shutdownThomas Graf
When initiating a graceful shutdown while having data chunks on the retransmission queue with a peer which is in zero window mode the shutdown is never completed because the retransmission error count is reset periodically by the following two rules: - Do not timeout association while doing zero window probe. - Reset overall error count when a heartbeat request has been acknowledged. The graceful shutdown will wait for all outstanding TSN to be acknowledged before sending the SHUTDOWN request. This never happens due to the peer's zero window not acknowledging the continuously retransmitted data chunks. Although the error counter is incremented for each failed retransmission, the receiving of the SACK announcing the zero window clears the error count again immediately. Also heartbeat requests continue to be sent periodically. The peer acknowledges these requests causing the error counter to be reset as well. This patch changes behaviour to only reset the overall error counter for the above rules while not in shutdown. After reaching the maximum number of retransmission attempts, the T5 shutdown guard timer is scheduled to give the receiver some additional time to recover. The timer is stopped as soon as the receiver acknowledges any data. The issue can be easily reproduced by establishing a sctp association over the loopback device, constantly queueing data at the sender while not reading any at the receiver. Wait for the window to reach zero, then initiate a shutdown by killing both processes simultaneously. The association will never be freed and the chunks on the retransmission queue will be retransmitted indefinitely. Signed-off-by: Thomas Graf <tgraf@infradead.org> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (31 commits) sctp: fix missing send up SCTP_SENDER_DRY_EVENT when subscribe it net: refine {udp|tcp|sctp}_mem limits vmxnet3: round down # of queues to power of two net: sh_eth: fix the parameter for the ETHER of SH7757 net: sh_eth: fix cannot work half-duplex mode net: vlan: enable soft features regardless of underlying device vmxnet3: fix starving rx ring whenoc_skb kb fails bridge: Always flood broadcast packets greth: greth_set_mac_add would corrupt the MAC address. net: bind() fix error return on wrong address family natsemi: silence dma-debug warnings net: 8139too: Initial necessary vlan_features to support vlan Fix call trace when interrupts are disabled while sleeping function kzalloc is called qlge:Version change to v1.00.00.29 qlge: Fix printk priority so chip fatal errors are always reported. qlge:Fix crash caused by mailbox execution on wedged chip. xfrm4: Don't call icmp_send on local error ipv4: Don't use ufo handling on later transformed packets xfrm: Remove family arg from xfrm_bundle_ok ipv6: Don't put artificial limit on routing table size. ...
2011-07-07mac80211: fix TKIP replay vulnerabilityJohannes Berg
Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg <johannes@sipsolutions.net> Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-07mac80211: fix ie memory allocation for scheduled scansLuciano Coelho
We were not allocating memory for the IEs passed in the scheduled_scan request and this was causing memory corruption (buffer overflow). Signed-off-by: Luciano Coelho <coelho@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-27 02:44:34 +0000