When the last RFCOMM data channel is closed, a timer is normally set
up to disconnect the control channel at a later time. If the control
channel disconnect command is sent with the timer pending, the timer
needs to be cancelled.
If the timer is not cancelled in this situation, the reference
counting logic for the RFCOMM session does not work correctly when the
remote device closes the L2CAP connection. The session is freed at
the wrong time, leading to a kernel panic.
CRs-fixed: 317859
Change-Id: I778fdf8dbff8afe0a1c157b02d39872262088584
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
When local device is done sending LE pairing keys, it should not
be sending a pairing failure event to User space.
Change-Id: I49d77040e8f72567c0c7ece053aa58227c87a0f0
Signed-off-by: Brian Gix <bgix@codeaurora.org>
* common/android-3.0: (570 commits)
misc: remove kernel debugger core
ARM: common: fiq_debugger: dump sysrq directly to console if enabled
ARM: common: fiq_debugger: add irq context debug functions
net: wireless: bcmdhd: Call init_ioctl() only if was started properly for WEXT
net: wireless: bcmdhd: Call init_ioctl() only if was started properly
net: wireless: bcmdhd: Fix possible memory leak in escan/iscan
cpufreq: interactive governor: default 20ms timer
cpufreq: interactive governor: go to intermediate hi speed before max
cpufreq: interactive governor: scale to max only if at min speed
cpufreq: interactive governor: apply intermediate load on current speed
ARM: idle: update idle ticks before call idle end notifier
input: gpio_input: don't print debounce message unless flag is set
net: wireless: bcm4329: Skip dhd_bus_stop() if bus is already down
net: wireless: bcmdhd: Skip dhd_bus_stop() if bus is already down
net: wireless: bcmdhd: Improve suspend/resume processing
net: wireless: bcmdhd: Check if FW is Ok for internal FW call
tcp: Don't nuke connections for the wrong protocol
ARM: common: fiq_debugger: make uart irq be no_suspend
net: wireless: Skip connect warning for CONFIG_CFG80211_ALLOW_RECONNECT
mm: avoid livelock on !__GFP_FS allocations
...
Conflicts:
arch/arm/mm/cache-l2x0.c
arch/arm/vfp/vfpmodule.c
drivers/mmc/core/host.c
kernel/power/wakelock.c
net/bluetooth/hci_event.c
Signed-off-by: Bryan Huntsman <bryanh@codeaurora.org>
Previously an offset was added to the hci dev number to generate the
AMP controller ID, because it was possible for the PAL to register
as hci0, and 0 is invalid for an AMP controller ID. Since this commit
462bf76d29 it is not possible for
the PAL to register as hci0, so this offset is no longer necessary.
Change-Id: I4b01ddca5fad3aebeb4c138b5aee8819bb146f3d
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
In three places a reference was taken without being returned.
Change-Id: I15b9ab7de530a77832d8b10fe756cfdf0b01760f
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
Since all AMP Manager processing is done on work queues no
bottom-half locking is required.
CRs-fixed: 318632
Change-Id: I3a07c412ccf30d62d68cc80124fad5700bcc0917
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
If we initiated a Dedicated pairing, and the remote device
is a NoInputNoOutput capable device, allow auto-acceptance
of pairing.
Change-Id: Ia5cc3e3d458cee98aef0493a423d29e9955638c3
CRs-fixed: 318144
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Currently, calling tcp_nuke_addr to reset IPv6 connections
resets IPv4 connections as well, because all Android
framework sockets are dual-stack (i.e., IPv6) sockets, and
we don't check the source address to see if the connection
was in fact an IPv4 connection.
Fix this by checking the source address and not resetting
the connection if it's a mapped address.
Also slightly tweak the IPv4 code path, which doesn't check
for mapped addresses either. This was not causing any
problems because tcp_is_local normally always returns true
for LOOPBACK4_IPV6 (127.0.0.6), because the loopback
interface is configured as as 127.0.0.0/8. However,
checking explicitly for LOOPBACK4_IPV6 makes the code a bit
more robust.
Bug: 5535055
Change-Id: I4d6ed3497c5b8643c864783cf681f088cf6b8d2a
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
On some platforms, device state data can be left around, and some
commands may take longer than 1 second to execute. This change increases
the per command time-out, and reinitializes the features mask.
Change-Id: Ib707996b97139c97e9a0deacd4a11019cf75da8c
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Include auto-setting connection parameters during Pairing for
low latenecy, and default (high latency) settings for non-Pairing
connections.
Change-Id: Ie8e3f65da52213451dcc01fce38d95ae07d1b13b
Signed-off-by: Brian Gix <bgix@codeaurora.org>
The upstream kernel has acquired new BT socket options since
BT_AMP_POLICY was first defined, now BT_FLUSHABLE is option 8 and
BT_POWER is option 9. It will save us some future pain if we align
with upstream code now and make BT_AMP_POLICY be option 10.
In addition, the option values for BT_AMP_POLICY were changed during
the upstreaming process.
CRs-fixed: 313757
Change-Id: Ia31e9c8cfd5207a6dd44e40a605d3021f5ce9fd9
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
A socket can be shut down while pointer to that socket is stored in a
queued skbuff or in a pending workqueue struct. Correct use of socket
reference counting will make sure the socket struct stays around until
there are no remaining references.
Change-Id: Ic3679e023a46b224929b3cefb6370d7871e3368a
CRs-fixed: 313736
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Whenever local device name is changed, EIR payload
is updated with the modified local device name.
CRs-fixed: 314228
Change-Id: Ib2ec05b6ac4f4a55612716f0567ee04056579ed6
Signed-off-by: Royston Rodrigues <roystonr@codeaurora.org>
LE-Only devices require that an Address Type (Public or Random) be
included in Connection Requests. This info is available at Pairing
but must be cached so that it is available at reconnection time.
This change includes the Address type with the Pairing data.
Change-Id: I50c78ad31d8be70f5c3f49a0529039e4a26daaac
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Add the reference count for Smart Wireless Interface Manager to
know whether there are any process who still has the socket in
question in use or not.
Enable INET DIAG.
Redefine the TCP_FLAG as it gives compiling error when an enum is defined
by a function return.
Change-Id: I1aa9c810fec2e332048c9ef4199ec3f996bc3a75
Signed-off-by: Chinh Tran <chinht@codeaurora.org>
If LE link gets terminated during the pairing process, it
may leave SMP with half of a Long Term Key. This fix ensures
that this partial information is not used for future links.
Change-Id: Ib834fc81d7b4b558cc3d242522acef80dd1d8827
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Before attempting to create a channel directly on an AMP check
that the remote device supports A2MP signalling before starting
the physical link creation process.
Change-Id: Iac2bcebf9630368685e24e636e39ffa82651705d
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.
x25_find_listener does not check that the amount of call user data given
in the skb is big enough in per-socket comparisons, hence buffer
overreads may occur. Fix this by adding a check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes the issue caused by ef81bb40bf
which is a backport of upstream 87c48fa3b4630905f98268dde838ee43626a060c. The
problem does not exist in upstream.
We do not check whether route is attached before trying to assign ip
identification through route dest which lead NULL pointer dereference. This
happens when host bridge transmit a packet from guest.
This patch changes ipv6_select_ident() to accept in6_addr as its paramter and
fix the issue by using the destination address in ipv6 header when no route is
attached.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix setting of ENCRYPTION_PENDING and Connection refcnt's that could
be out of sync due to remote slave issued security requests.
Change-Id: Ie72abd0648182db0ef60693820139f40ef2e4bf6
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Socket lookup for a fixed channel should be done based on both remote and
local device addresses.
Change-Id: I35f39bea8ade6fd5d8695640251efc54bf21beae
Signed-off-by: Inga Stotland <ingas@codeaurora.org>
If LE devices stop advertising or go out of range, we need
to apply a timeout because the baseband doesn't.
Change-Id: I115672e21fd8aef56ac688b2df4664bb74b725e4
Signed-off-by: Brian Gix <bgix@codeaurora.org>
Because for now the xt_qtaguid module allows procs to use tags without
having /dev/xt_qtaguid open, there was a case where it would try
to delete a resources from a list that was proc specific.
But that resource was never added to that list which is only
used when /dev/xt_qtaguid has been opened by the proc.
Once our userspace is fully updated, we won't need those exceptions.
Change-Id: Idd4bfea926627190c74645142916e10832eb2504
Signed-off-by: JP Abgrall <jpa@google.com>
Since rx_bytes accounting does not include Ethernet Headers in
br_input.c, excluding ETH_HLEN on the transmit path for consistent
measurement of packet length on both the Tx and Rx chains.
The clean way would be for Rx to include the eth header, but the
skb len has already been adjusted by the time the br code sees the skb.
This is only a temporary workaround until we can completely ignore or
cleanly fix the skb->len handling.
Change-Id: I910de95a4686b2119da7f1f326e2154ef31f9972
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
Store the link key persistently if one of the following is true:
1. this is a legacy link key
2. this is a changed combination key and there was a previously
stored one
3. neither local nor remote side had no-bonding as a requirement
4. the local side had dedicated bonding as a requirement
5. the remote side is using dedicated bonding since in that case
also the local requirements are set to dedicated bonding
If none of the above match only keep the link key around for
this connection and set the temporary flag for the device.
CRs-Fixed: 309161
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
