Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c1f5b45 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 



Johan Hedberg says:

====================
pull request: bluetooth 2016-08-25

Here are a couple of important Bluetooth fixes for the 4.8 kernel:

 - Memory leak fix for HCI requests
 - Fix sk_filter handling with L2CAP
 - Fix sock_recvmsg behavior when MSG_TRUNC is not set

Please let me know if there are any issues pulling. Thanks.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c15e07b0 4f34228b

net/bluetooth/af_bluetooth.c

+1 −1
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 


	skb_free_datagram(sk, skb);



	if (msg->msg_flags & MSG_TRUNC)

	if (flags & MSG_TRUNC)

		copied = skblen;



	return err ? : copied;

net/bluetooth/hci_request.c

+2 −0
Original line number Diff line number Diff line
@@ -262,6 +262,8 @@ int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req, 
		break;

	}



	kfree_skb(hdev->req_skb);

	hdev->req_skb = NULL;

	hdev->req_status = hdev->req_result = 0;



	BT_DBG("%s end: err %d", hdev->name, err);

net/bluetooth/hci_sock.c

+1 −1
Original line number Diff line number Diff line
@@ -1091,7 +1091,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 


	skb_free_datagram(sk, skb);



	if (msg->msg_flags & MSG_TRUNC)

	if (flags & MSG_TRUNC)

		copied = skblen;



	return err ? : copied;

net/bluetooth/l2cap_core.c

+8 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 


#include <linux/debugfs.h>

#include <linux/crc16.h>

#include <linux/filter.h>



#include <net/bluetooth/bluetooth.h>

#include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 
		if (chan->sdu)

			break;



		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))

			break;



		chan->sdu_len = get_unaligned_le16(skb->data);

		skb_pull(skb, L2CAP_SDULEN_SIZE);
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 
		goto drop;

	}



	if ((chan->mode == L2CAP_MODE_ERTM ||

	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))

		goto drop;



	if (!control->sframe) {

		int err;

net/bluetooth/l2cap_sock.c

+12 −2
Original line number Diff line number Diff line
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, 
		goto done;



	if (pi->rx_busy_skb) {

		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))

		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))

			pi->rx_busy_skb = NULL;

		else

			goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 
		goto done;

	}



	err = sock_queue_rcv_skb(sk, skb);

	if (chan->mode != L2CAP_MODE_ERTM &&

	    chan->mode != L2CAP_MODE_STREAMING) {

		/* Even if no filter is attached, we could potentially

		 * get errors from security modules, etc.

		 */

		err = sk_filter(sk, skb);

		if (err)

			goto done;

	}



	err = __sock_queue_rcv_skb(sk, skb);



	/* For ERTM, handle one skb that doesn't fit into the recv

	 * buffer.  This is important to do because the data frames