History

Merge tag 'for-net-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fixes various issues related to ISO channel/socket support - Fixes issues when building with C=1 - Fix cancel uninitilized work which blocks syzbot to run * tag 'for-net-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: ISO: Fix not using the correct QoS Bluetooth: don't try to cancel uninitialized works at mgmt_index_removed() Bluetooth: ISO: Fix iso_sock_getsockopt for BT_DEFER_SETUP Bluetooth: MGMT: Fixes build warnings with C=1 Bluetooth: hci_event: Fix build warning with C=1 Bluetooth: ISO: Fix memory corruption Bluetooth: Fix null pointer deref on unexpected status event Bluetooth: ISO: Fix info leak in iso_sock_getsockopt() Bluetooth: hci_conn: Fix updating ISO QoS PHY Bluetooth: ISO: unlock on error path in iso_sock_setsockopt() Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression ====================

Jakub Kicinski committed 4 years ago

Commit b8c3bf02 parents 7a07a29 1d1ab5d7 files · +64 −39Browse files

Unified · Split

7 files
  1. net/bluetooth/aosp.c +12 −3
  2. net/bluetooth/hci_conn.c +2 −9
  3. net/bluetooth/hci_event.c +5 −2
  4. net/bluetooth/iso.c +23 −12
  5. net/bluetooth/l2cap_core.c +6 −7
  6. net/bluetooth/mgmt.c +4 −3
  7. net/bluetooth/msft.c +12 −3
net/bluetooth/aosp.c+12−3
@@ -54,7 +54,10 @@ void aosp_do_open(struct hci_dev *hdev) · 53 unmodified lines
54 /* LE Get Vendor Capabilities Command */54 /* LE Get Vendor Capabilities Command */
55 skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL,55 skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL,
56 HCI_CMD_TIMEOUT);56 HCI_CMD_TIMEOUT);
57 if (IS_ERR(skb)) {57 if (IS_ERR_OR_NULL(skb)) {
58 if (!skb)
59 skb = ERR_PTR(-EIO);
60
58 bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)",61 bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)",
59 PTR_ERR(skb));62 PTR_ERR(skb));
60 return;63 return;
@@ -152,7 +155,10 @@ static int enable_quality_report(struct hci_dev *hdev) · 91 unmodified lines
152 155
153 skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,156 skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
154 HCI_CMD_TIMEOUT);157 HCI_CMD_TIMEOUT);
155 if (IS_ERR(skb)) {158 if (IS_ERR_OR_NULL(skb)) {
159 if (!skb)
160 skb = ERR_PTR(-EIO);
161
156 bt_dev_err(hdev, "Enabling Android BQR failed (%ld)",162 bt_dev_err(hdev, "Enabling Android BQR failed (%ld)",
157 PTR_ERR(skb));163 PTR_ERR(skb));
158 return PTR_ERR(skb);164 return PTR_ERR(skb);
@@ -171,7 +177,10 @@ static int disable_quality_report(struct hci_dev *hdev) · 12 unmodified lines
171 177
172 skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,178 skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
173 HCI_CMD_TIMEOUT);179 HCI_CMD_TIMEOUT);
174 if (IS_ERR(skb)) {180 if (IS_ERR_OR_NULL(skb)) {
181 if (!skb)
182 skb = ERR_PTR(-EIO);
183
175 bt_dev_err(hdev, "Disabling Android BQR failed (%ld)",184 bt_dev_err(hdev, "Disabling Android BQR failed (%ld)",
176 PTR_ERR(skb));185 PTR_ERR(skb));
177 return PTR_ERR(skb);186 return PTR_ERR(skb);
net/bluetooth/hci_conn.c+2−9
@@ -1551,8 +1551,8 @@ static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos) · 1550 unmodified lines
1551 cis->cis_id = qos->cis;1551 cis->cis_id = qos->cis;
1552 cis->c_sdu = cpu_to_le16(qos->out.sdu);1552 cis->c_sdu = cpu_to_le16(qos->out.sdu);
1553 cis->p_sdu = cpu_to_le16(qos->in.sdu);1553 cis->p_sdu = cpu_to_le16(qos->in.sdu);
1554 cis->c_phy = qos->out.phy;1554 cis->c_phy = qos->out.phy ? qos->out.phy : qos->in.phy;
1555 cis->p_phy = qos->in.phy;1555 cis->p_phy = qos->in.phy ? qos->in.phy : qos->out.phy;
1556 cis->c_rtn = qos->out.rtn;1556 cis->c_rtn = qos->out.rtn;
1557 cis->p_rtn = qos->in.rtn;1557 cis->p_rtn = qos->in.rtn;
1558 1558
@@ -1735,13 +1735,6 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, · 176 unmodified lines
1735 if (!qos->in.latency)1735 if (!qos->in.latency)
1736 qos->in.latency = qos->out.latency;1736 qos->in.latency = qos->out.latency;
1737 1737
1738 /* Mirror PHYs that are disabled as SDU will be set to 0 */
1739 if (!qos->in.phy)
1740 qos->in.phy = qos->out.phy;
1741
1742 if (!qos->out.phy)
1743 qos->out.phy = qos->in.phy;
1744
1745 if (!hci_le_set_cig_params(cis, qos)) {1738 if (!hci_le_set_cig_params(cis, qos)) {
1746 hci_conn_drop(cis);1739 hci_conn_drop(cis);
1747 return ERR_PTR(-EINVAL);1740 return ERR_PTR(-EINVAL);
net/bluetooth/hci_event.c+5−2
@@ -328,14 +328,17 @@ static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data, · 327 unmodified lines
328 struct sk_buff *skb)328 struct sk_buff *skb)
329{329{
330 struct hci_rp_delete_stored_link_key *rp = data;330 struct hci_rp_delete_stored_link_key *rp = data;
331 u16 num_keys;
331 332
332 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);333 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
333 334
334 if (rp->status)335 if (rp->status)
335 return rp->status;336 return rp->status;
336 337
337 if (rp->num_keys <= hdev->stored_num_keys)338 num_keys = le16_to_cpu(rp->num_keys);
338 hdev->stored_num_keys -= le16_to_cpu(rp->num_keys);339
340 if (num_keys <= hdev->stored_num_keys)
341 hdev->stored_num_keys -= num_keys;
339 else342 else
340 hdev->stored_num_keys = 0;343 hdev->stored_num_keys = 0;
341 344
net/bluetooth/iso.c+23−12
@@ -44,6 +44,9 @@ static void iso_sock_kill(struct sock *sk); · 43 unmodified lines
44/* ----- ISO socket info ----- */44/* ----- ISO socket info ----- */
45#define iso_pi(sk) ((struct iso_pinfo *)sk)45#define iso_pi(sk) ((struct iso_pinfo *)sk)
46 46
47#define EIR_SERVICE_DATA_LENGTH 4
48#define BASE_MAX_LENGTH (HCI_MAX_PER_AD_LENGTH - EIR_SERVICE_DATA_LENGTH)
49
47struct iso_pinfo {50struct iso_pinfo {
48 struct bt_sock bt;51 struct bt_sock bt;
49 bdaddr_t src;52 bdaddr_t src;
@@ -57,7 +60,7 @@ struct iso_pinfo { · 7 unmodified lines
57 __u32 flags;60 __u32 flags;
58 struct bt_iso_qos qos;61 struct bt_iso_qos qos;
59 __u8 base_len;62 __u8 base_len;
60 __u8 base[HCI_MAX_PER_AD_LENGTH];63 __u8 base[BASE_MAX_LENGTH];
61 struct iso_conn *conn;64 struct iso_conn *conn;
62};65};
63 66
@@ -370,15 +373,24 @@ done: · 306 unmodified lines
370 return err;373 return err;
371}374}
372 375
376static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)
377{
378 if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)
379 return &iso_pi(sk)->conn->hcon->iso_qos;
380
381 return &iso_pi(sk)->qos;
382}
383
373static int iso_send_frame(struct sock *sk, struct sk_buff *skb)384static int iso_send_frame(struct sock *sk, struct sk_buff *skb)
374{385{
375 struct iso_conn *conn = iso_pi(sk)->conn;386 struct iso_conn *conn = iso_pi(sk)->conn;
387 struct bt_iso_qos *qos = iso_sock_get_qos(sk);
376 struct hci_iso_data_hdr *hdr;388 struct hci_iso_data_hdr *hdr;
377 int len = 0;389 int len = 0;
378 390
379 BT_DBG("sk %p len %d", sk, skb->len);391 BT_DBG("sk %p len %d", sk, skb->len);
380 392
381 if (skb->len > iso_pi(sk)->qos.out.sdu)393 if (skb->len > qos->out.sdu)
382 return -EMSGSIZE;394 return -EMSGSIZE;
383 395
384 len = skb->len;396 len = skb->len;
@@ -1177,8 +1189,10 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, · 792 unmodified lines
1177 }1189 }
1178 1190
1179 len = min_t(unsigned int, sizeof(qos), optlen);1191 len = min_t(unsigned int, sizeof(qos), optlen);
1180 if (len != sizeof(qos))1192 if (len != sizeof(qos)) {
1181 return -EINVAL;1193 err = -EINVAL;
1194 break;
1195 }
1182 1196
1183 memset(&qos, 0, sizeof(qos));1197 memset(&qos, 0, sizeof(qos));
1184 1198
@@ -1233,7 +1247,7 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname, · 48 unmodified lines
1233{1247{
1234 struct sock *sk = sock->sk;1248 struct sock *sk = sock->sk;
1235 int len, err = 0;1249 int len, err = 0;
1236 struct bt_iso_qos qos;1250 struct bt_iso_qos *qos;
1237 u8 base_len;1251 u8 base_len;
1238 u8 *base;1252 u8 *base;
1239 1253
@@ -1246,7 +1260,7 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname, · 6 unmodified lines
1246 1260
1247 switch (optname) {1261 switch (optname) {
1248 case BT_DEFER_SETUP:1262 case BT_DEFER_SETUP:
1249 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {1263 if (sk->sk_state == BT_CONNECTED) {
1250 err = -EINVAL;1264 err = -EINVAL;
1251 break;1265 break;
1252 }1266 }
@@ -1258,13 +1272,10 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname, · 5 unmodified lines
1258 break;1272 break;
1259 1273
1260 case BT_ISO_QOS:1274 case BT_ISO_QOS:
1261 if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)1275 qos = iso_sock_get_qos(sk);
1262 qos = iso_pi(sk)->conn->hcon->iso_qos;
1263 else
1264 qos = iso_pi(sk)->qos;
1265 1276
1266 len = min_t(unsigned int, len, sizeof(qos));1277 len = min_t(unsigned int, len, sizeof(*qos));
1267 if (copy_to_user(optval, (char *)&qos, len))1278 if (copy_to_user(optval, qos, len))
1268 err = -EFAULT;1279 err = -EFAULT;
1269 1280
1270 break;1281 break;
net/bluetooth/l2cap_core.c+6−7
@@ -1970,11 +1970,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, · 1969 unmodified lines
1970 bdaddr_t *dst,1970 bdaddr_t *dst,
1971 u8 link_type)1971 u8 link_type)
1972{1972{
1973 struct l2cap_chan *c, *c1 = NULL;1973 struct l2cap_chan *c, *tmp, *c1 = NULL;
1974 1974
1975 read_lock(&chan_list_lock);1975 read_lock(&chan_list_lock);
1976 1976
1977 list_for_each_entry(c, &chan_list, global_l) {1977 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1978 if (state && c->state != state)1978 if (state && c->state != state)
1979 continue;1979 continue;
1980 1980
@@ -1993,11 +1993,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, · 12 unmodified lines
1993 dst_match = !bacmp(&c->dst, dst);1993 dst_match = !bacmp(&c->dst, dst);
1994 if (src_match && dst_match) {1994 if (src_match && dst_match) {
1995 c = l2cap_chan_hold_unless_zero(c);1995 c = l2cap_chan_hold_unless_zero(c);
1996 if (!c)1996 if (c) {
1997 continue;1997 read_unlock(&chan_list_lock);
1998 1998 return c;
1999 read_unlock(&chan_list_lock);1999 }
2000 return c;
2001 }2000 }
2002 2001
2003 /* Closest match */2002 /* Closest match */
net/bluetooth/mgmt.c+4−3
@@ -3819,7 +3819,7 @@ static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, · 3818 unmodified lines
3819 3819
3820 hci_blocked_keys_clear(hdev);3820 hci_blocked_keys_clear(hdev);
3821 3821
3822 for (i = 0; i < keys->key_count; ++i) {3822 for (i = 0; i < key_count; ++i) {
3823 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);3823 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3824 3824
3825 if (!b) {3825 if (!b) {
@@ -4624,8 +4624,7 @@ static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, · 798 unmodified lines
4624 u32 current_flags = __le32_to_cpu(cp->current_flags);4624 u32 current_flags = __le32_to_cpu(cp->current_flags);
4625 4625
4626 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",4626 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4627 &cp->addr.bdaddr, cp->addr.type,4627 &cp->addr.bdaddr, cp->addr.type, current_flags);
4628 __le32_to_cpu(current_flags));
4629 4628
4630 // We should take hci_dev_lock() early, I think.. conn_flags can change4629 // We should take hci_dev_lock() early, I think.. conn_flags can change
4631 supported_flags = hdev->conn_flags;4630 supported_flags = hdev->conn_flags;
@@ -8936,6 +8935,8 @@ void mgmt_index_removed(struct hci_dev *hdev) · 4304 unmodified lines
8936 HCI_MGMT_EXT_INDEX_EVENTS);8935 HCI_MGMT_EXT_INDEX_EVENTS);
8937 8936
8938 /* Cancel any remaining timed work */8937 /* Cancel any remaining timed work */
8938 if (!hci_dev_test_flag(hdev, HCI_MGMT))
8939 return;
8939 cancel_delayed_work_sync(&hdev->discov_off);8940 cancel_delayed_work_sync(&hdev->discov_off);
8940 cancel_delayed_work_sync(&hdev->service_cache);8941 cancel_delayed_work_sync(&hdev->service_cache);
8941 cancel_delayed_work_sync(&hdev->rpa_expired);8942 cancel_delayed_work_sync(&hdev->rpa_expired);
net/bluetooth/msft.c+12−3
@@ -120,7 +120,10 @@ static bool read_supported_features(struct hci_dev *hdev, · 119 unmodified lines
120 120
121 skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,121 skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
122 HCI_CMD_TIMEOUT);122 HCI_CMD_TIMEOUT);
123 if (IS_ERR(skb)) {123 if (IS_ERR_OR_NULL(skb)) {
124 if (!skb)
125 skb = ERR_PTR(-EIO);
126
124 bt_dev_err(hdev, "Failed to read MSFT supported features (%ld)",127 bt_dev_err(hdev, "Failed to read MSFT supported features (%ld)",
125 PTR_ERR(skb));128 PTR_ERR(skb));
126 return false;129 return false;
@@ -319,8 +322,11 @@ static int msft_remove_monitor_sync(struct hci_dev *hdev, · 192 unmodified lines
319 322
320 skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,323 skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
321 HCI_CMD_TIMEOUT);324 HCI_CMD_TIMEOUT);
322 if (IS_ERR(skb))325 if (IS_ERR_OR_NULL(skb)) {
326 if (!skb)
327 return -EIO;
323 return PTR_ERR(skb);328 return PTR_ERR(skb);
329 }
324 330
325 return msft_le_cancel_monitor_advertisement_cb(hdev, hdev->msft_opcode,331 return msft_le_cancel_monitor_advertisement_cb(hdev, hdev->msft_opcode,
326 monitor, skb);332 monitor, skb);
@@ -432,8 +438,11 @@ static int msft_add_monitor_sync(struct hci_dev *hdev, · 105 unmodified lines
432 HCI_CMD_TIMEOUT);438 HCI_CMD_TIMEOUT);
433 kfree(cp);439 kfree(cp);
434 440
435 if (IS_ERR(skb))441 if (IS_ERR_OR_NULL(skb)) {
442 if (!skb)
443 return -EIO;
436 return PTR_ERR(skb);444 return PTR_ERR(skb);
445 }
437 446
438 return msft_le_monitor_advertisement_cb(hdev, hdev->msft_opcode,447 return msft_le_monitor_advertisement_cb(hdev, hdev->msft_opcode,
439 monitor, skb);448 monitor, skb);