Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Johan Hedberg says:

====================
pull request: bluetooth 2016-08-25

Here are a couple of important Bluetooth fixes for the 4.8 kernel:

 - Memory leak fix for HCI requests
 - Fix sk_filter handling with L2CAP
 - Fix sock_recvmsg behavior when MSG_TRUNC is not set

Please let me know if there are any issues pulling. Thanks.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

5 files changed, 24 insertions, 4 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ece45e0683fd..0b5f729d08d2 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -250,7 +250,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index c045b3c54768..b0e23dfc5c34 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -262,6 +262,8 @@ int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
                 break;
         }
 
+        kfree_skb(hdev->req_skb);
+        hdev->req_skb = NULL;
         hdev->req_status = hdev->req_result = 0;
 
         BT_DBG("%s end: err %d", hdev->name, err);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6ef8a01a9ad4..96f04b7b9556 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1091,7 +1091,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 54ceb1f2cc9a..d4cad29b033f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -32,6 +32,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
                 if (chan->sdu)
                         break;
 
+                if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+                        break;
+
                 chan->sdu_len = get_unaligned_le16(skb->data);
                 skb_pull(skb, L2CAP_SDULEN_SIZE);
 
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto drop;
         }
 
+        if ((chan->mode == L2CAP_MODE_ERTM ||
+             chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+                goto drop;
+
         if (!control->sframe) {
                 int err;
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1842141baedb..a8ba752732c9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
                 goto done;
 
         if (pi->rx_busy_skb) {
-                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
                         pi->rx_busy_skb = NULL;
                 else
                         goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto done;
         }
 
-        err = sock_queue_rcv_skb(sk, skb);
+        if (chan->mode != L2CAP_MODE_ERTM &&
+            chan->mode != L2CAP_MODE_STREAMING) {
+                /* Even if no filter is attached, we could potentially
+                 * get errors from security modules, etc.
+                 */
+                err = sk_filter(sk, skb);
+                if (err)
+                        goto done;
+        }
+
+        err = __sock_queue_rcv_skb(sk, skb);
 
         /* For ERTM, handle one skb that doesn't fit into the recv
          * buffer.  This is important to do because the data frames