summaryrefslogtreecommitdiffstats
path: root/net/bluetooth
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | Bluetooth: Handle physical link completionMat Martineau2012-10-241-0/+164
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several different actions may be taken when an AMP physical link becomes available. A channel being created on an AMP controller must continue the connection process. A channel being moved needs to either send a move request or a move response. A failed physical link will revert to using a BR/EDR controller if possible. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add move confirm response handlingMat Martineau2012-10-241-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The move confirm response concludes the channel move command sequence. Receipt of this command indicates that data may begin to flow again. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add logical link confirmMat Martineau2012-10-241-11/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logical link confirm callback is executed when the AMP controller completes its logical link setup. During a channel move, a newly formed logical link allows a move responder to send a move channel response. A move initiator will send a move channel confirm. A failed logical link will end the channel move and send an appropriate response or confirm command indicating a failure. If the channel is being created on an AMP controller, L2CAP configuration is completed after the logical link is set up. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Move channel responseMat Martineau2012-10-241-15/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The move response command includes a result code indicating "pending", "success", or "failure" status. A pending result is received when the remote address is still setting up a physical link, and will be followed by success or failure. On success, logical link setup will proceed. On failure, the move is stopped. The receiver of a move channel response must always follow up by sending a move channel confirm command. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add state to hci_chanMat Martineau2012-10-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On an AMP controller, hci_chan maps to a logical link. When a channel is being moved, the logical link may or may not be connected already. The hci_chan->state is used to determine the existance of a useable logical link so the link can be either used or requested. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add move channel confirm handlingMat Martineau2012-10-241-3/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After sending a move channel response, a move responder waits for a move channel confirm command. If the received command has a "confirmed" result the move is proceeding, and "unconfirmed" means the move has failed and the channel will not change controllers. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add new ERTM receive states for channel moveMat Martineau2012-10-241-0/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two new states are required to implement channel moves with the ERTM receive state machine. The "WAIT_P" state is used by a move responder to wait for a "poll" flag after a move is completed (success or failure). "WAIT_F" is similarly used by a move initiator to wait for a "final" flag when the move is completing. In either state, the reqseq value in the poll/final frame tells the state machine exactly which frame should be expected next. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Channel move request handlingMat Martineau2012-10-241-1/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On receipt of a channel move request, the request must be validated based on the L2CAP mode, connection state, and controller capabilities. ERTM channels must have their state machines cleared and transmission paused while the channel move takes place. If the channel is being moved to an AMP controller then an AMP physical link must be prepared. Moving the channel back to BR/EDR proceeds immediately. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Lookup channel structure based on DCIDMat Martineau2012-10-241-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Processing a move channel request involves getting the channel structure using the destination channel ID. Previous code could only look up using the source channel ID. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Remove unnecessary intermediate functionMat Martineau2012-10-231-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves a conflict resolution issue in "Bluetooth: Fix L2CAP coding style". The remaining connect and create channel response handler is renamed to better reflect its use for both response types. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add L2CAP create channel request handlingMat Martineau2012-10-231-15/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The L2CAP create channel request is very similar to an L2CAP connect request, but it has an additional parameter for the controller ID. If the controller id is 0, the channel is set up on the BR/EDR controller (just like a connect request). Using a valid high speed controller ID will cause the channel to be initially created on that high speed controller. While the L2CAP data will be initially routed over the AMP controller, the L2CAP fixed signaling channel only uses BR/EDR. When a create channel request is received for a high speed controller, a pending response is always sent first. After the high speed physical and logical links are complete a success response will be sent. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add new l2cap_chan struct members for high speed channelsMat Martineau2012-10-231-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An L2CAP channel using high speed continues to be associated with a BR/EDR l2cap_conn, while also tracking an additional hci_conn (representing a physical link on a high speed controller) and hci_chan (representing a logical link). There may only be one physical link between two high speed controllers. Each physical link may contain several logical links, with each logical link representing a channel with specific quality of service. During a channel move, the destination channel id, current move state, and role (initiator vs. responder) are tracked and used by the channel move state machine. The ident value associated with a move request must also be stored in order to use it in later move responses. The active channel is stored in local_amp_id. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
* | | | Merge branch 'master' of ↵John W. Linville2012-10-231-2/+4
|\ \ \ \ | |/ / / |/| / / | |/ / | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless Conflicts: drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c net/mac80211/mlme.c
| * | Merge branch 'master' of ↵John W. Linville2012-10-151-2/+4
| |\ \ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
| | * | Bluetooth: SMP: Fix setting unknown auth_req bitsJohan Hedberg2012-10-121-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When sending a pairing request or response we should not just blindly copy the value that the remote device sent. Instead we should at least make sure to mask out any unknown bits. This is particularly critical from the upcoming LE Secure Connections feature perspective as incorrectly indicating support for it (by copying the remote value) would cause a failure to pair with devices that support it. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: stable@kernel.org Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
* | | | Merge branch 'master' of ↵John W. Linville2012-10-1921-372/+1458
|\ \ \ \ | |/ / / |/| | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
| * | | Bluetooth: AMP: Get amp_mgr reference in HS hci_connAndrei Emeltchenko2012-10-182-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When assigning amp_mgr in hci_conn (type AMP_LINK) get also reference. In hci_conn_del those references would be put for both conn types AMP_LINK and ACL_LINK associated with amp_mgr. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Zero bredr pointer when chan is deletedAndrei Emeltchenko2012-10-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If BREDR L2CAP chan is deleted and this chan is the channel through which High Speed traffic is routed to AMP then zero pointer to the chan in amp_mgr to prevent accessing it. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Send EFS Conf Rsp only for BR/EDR chanAndrei Emeltchenko2012-10-151-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not send EFS Configuration Response for High Speed channel yet. It will be sent after receiving Logical Link Complete event. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Drop packets when no l2cap conn existAndrei Emeltchenko2012-10-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | High Speed hci_conn should always have l2cap_conn associated with it. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Handle complete frames in l2capAndrei Emeltchenko2012-10-151-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check flags type in switch statement and handle new frame type ACL_COMPLETE used for High Speed data over AMP. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Use Loglink handle in ACL Handle fieldAndrei Emeltchenko2012-10-151-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For AMP HCI controller use Logical Link handle in HCI ACL Handle field. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Rename __l2cap_connect() to l2cap_connect()Gustavo Padovan2012-10-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use of "__" usually means we need to call the function with a lock held, which is not the case here. Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Add chan->ops->defer()Gustavo Padovan2012-10-153-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When DEFER_SETUP is set defer() will trigger an authorization request to the userspace. l2cap_chan_no_defer() is meant to be used when one does not want to support DEFER_SETUP (A2MP for example). Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Move bt_accept_enqueue() to l2cap_sock.cGustavo Padovan2012-10-152-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is part of the move the parent socket usage to l2cap_sock.c The change is safe when it comes to locking, bt_accept_enqueue() is still protected by the parent socket lock inside the l2cap_sock_new_connection_cb() code. Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Call ops->teardown() without checking for NULLGustavo Padovan2012-10-121-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Users that don't implement teardown() should use l2cap_chan_no_teardown() Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Use locked l2cap_state_change()Gustavo Padovan2012-10-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | No one was protecting the state set in l2cap_send_disconn_req() Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: use l2cap_chan_set_err()Gustavo Padovan2012-10-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | l2cap_conn_unreliable() doesn't take the sk lock, so we need to take it using l2cap_chan_set_err(). Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Remove GFP_ATOMIC usage from l2cap_core.cGustavo Padovan2012-10-121-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since we change the Bluetooth core to run in process context we don't need to use GFP_ATOMIC in many of places we were using it. The we just replace by GFP_KERNEL. Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Fix L2CAP coding styleGustavo Padovan2012-10-122-171/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Follow the net subsystem coding style Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Factor out common L2CAP connection codeMat Martineau2012-10-121-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | L2CAP connect requests and create channel requests share a significant amount of code. This change moves common code to a new function. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Process create response and connect response identicallyMat Martineau2012-10-121-12/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Handle AMP_LINK connectionAndrei Emeltchenko2012-10-112-3/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AMP_LINK represents physical link between AMP controllers. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Handle number of compl blocks for AMP_LINKAndrei Emeltchenko2012-10-111-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add handling blocks count for AMP link. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Add handle to hci_chan structureAndrei Emeltchenko2012-10-111-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hci_chan will be identified by handle used in logical link creation process. This handle is used in AMP ACL-U packet handle field. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Handle AMP_LINK timeoutAndrei Emeltchenko2012-10-111-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When AMP_LINK timeouts execute HCI_OP_DISCONN_PHY_LINK as analog to HCI_OP_DISCONNECT for ACL_LINK. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Allow to set flush timeoutAndrei Emeltchenko2012-10-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enable setting of flush timeout via setsockopt Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Use __constant modifier for RFCOMM PSMSyam Sidhardhan2012-10-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the RFCOMM_PSM is constant, __constant_cpu_to_le16() is the right go here. Signed-off-by: Syam Sidhardhan <s.syam@samsung.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Use __constant modifier for L2CAP SMP CIDSyam Sidhardhan2012-10-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the L2CAP_CID_SMP is constant, __constant_cpu_to_le16() is the right go here. Signed-off-by: Syam Sidhardhan <s.syam@samsung.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: don't attempt to free a channel that wasn't createdSasha Levin2012-10-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We may currently attempt to free a channel which wasn't created due to an error in the initialization path, this would cause a NULL ptr deref. This would cause the following oops: [ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 12.919131] IP: [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919135] PGD 0 [ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 12.919193] Dumping ftrace buffer: [ 12.919242] (ftrace buffer empty) [ 12.919314] Modules linked in: [ 12.919318] CPU 1 [ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30 [ 12.919374] RIP: 0010:[<ffffffff836645c4>] [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246 [ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667 [ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010 [ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001 [ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000 [ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001 [ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000 [ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0 [ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000) [ 12.919506] Stack: [ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc [ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae [ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200 [ 12.919517] Call Trace: [ 12.919522] [<ffffffff8366c7bc>] l2cap_sock_destruct+0x3c/0x80 [ 12.919527] [<ffffffff833ae0ae>] __sk_free+0x1e/0x1f0 [ 12.919530] [<ffffffff833ae2f7>] sk_free+0x17/0x20 [ 12.919585] [<ffffffff8366ca4e>] l2cap_sock_alloc.constprop.5+0x9e/0xd0 [ 12.919591] [<ffffffff8366cb9e>] l2cap_sock_create+0x7e/0x100 [ 12.919652] [<ffffffff83a4f32a>] ? _raw_read_lock+0x6a/0x80 [ 12.919658] [<ffffffff836402c4>] ? bt_sock_create+0x74/0x110 [ 12.919660] [<ffffffff83640308>] bt_sock_create+0xb8/0x110 [ 12.919664] [<ffffffff833aa232>] __sock_create+0x282/0x3b0 [ 12.919720] [<ffffffff833aa0b0>] ? __sock_create+0x100/0x3b0 [ 12.919725] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919779] [<ffffffff833aa37f>] sock_create_kern+0x1f/0x30 [ 12.919784] [<ffffffff83675714>] rfcomm_l2sock_create+0x44/0x70 [ 12.919787] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919790] [<ffffffff836785fe>] rfcomm_run+0x4e/0x1f0 [ 12.919846] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919852] [<ffffffff81138ee3>] kthread+0xe3/0xf0 [ 12.919908] [<ffffffff8117b12e>] ? put_lock_stats.isra.14+0xe/0x40 [ 12.919914] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.919968] [<ffffffff83a5077c>] ret_from_fork+0x7c/0x90 [ 12.919973] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0 [ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80 ac 3a fe 48 8d 7b 10 <f0> 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08 [ 12.920165] RIP [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50 [ 12.920166] RSP <ffff880066933c38> [ 12.920167] CR2: 0000000000000010 [ 12.920417] ---[ end trace 5a9114e8a158ab84 ]--- Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan reference counting"). Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: L2CAP: Fix using default Flush Timeout for EFSAndrei Emeltchenko2012-10-081-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two Flush Timeouts: one is old Flush Timeot Option which is 2 octets and the second is Flush Timeout inside EFS which is 4 octets long. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Use block_mtu for AMP controllerAndrei Emeltchenko2012-10-081-3/+15
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Factor out phylink_addAndrei Emeltchenko2012-10-082-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Add direction parameter to phylink_add since it is anyway set later. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Factor out amp_ctrl_addAndrei Emeltchenko2012-10-082-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ctrl_id parameter to amp_ctrl_add since we always set it after function ctrl is created. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Fix dereference after NULL checkAndrei Emeltchenko2012-10-081-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Move code dereferencing possible NULL pointer to the check branch. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: AMP: Fix possible NULL dereferenceAndrei Emeltchenko2012-10-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Check that link key exist before accessing. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: A2MP: Fix potential NULL dereferenceAndrei Emeltchenko2012-10-011-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR controller and fixes dereference possible NULL pointer. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: A2MP: Correct assoc_len sizeAndrei Emeltchenko2012-09-281-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Correct assoc_len and fix warning for x86-64 by using %zu specifier. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Use %zu print specifier for size_t typeAndrei Emeltchenko2012-09-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Correct warnings Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
| * | | Bluetooth: Factor out Create Configuration ResponseAndrei Emeltchenko2012-09-271-13/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use function to factor out similar code. For BR/EDR send EFS Configuration Response immediately, for HS response will be sent after receiving HCI Logical Link Complete event in the following patches. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
generated by cgit v1.2.3 (git 2.46.0) at 2025-04-24 23:32:52 +0000