1 files changed, 111 insertions, 184 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 3204ba8a701c..5ea94a1eecf2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -251,7 +251,7 @@ static void l2cap_chan_timeout(unsigned long arg)
 
         if (sock_owned_by_user(sk)) {
                 /* sk is owned by user. Try again later */
-                __set_chan_timer(chan, HZ / 5);
+                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                 bh_unlock_sock(sk);
                 chan_put(chan);
                 return;
@@ -907,6 +907,9 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
         if (!conn->hcon->out && conn->hcon->type == LE_LINK)
                 l2cap_le_conn_ready(conn);
 
+        if (conn->hcon->out && conn->hcon->type == LE_LINK)
+                smp_conn_security(conn, conn->hcon->pending_sec_level);
+
         read_lock(&conn->chan_lock);
 
         list_for_each_entry(chan, &conn->chan_l, list) {
@@ -986,8 +989,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
                 del_timer_sync(&conn->info_timer);
 
-        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
                 del_timer(&conn->security_timer);
+                smp_chan_destroy(conn);
+        }
 
         hcon->l2cap_data = NULL;
         kfree(conn);
@@ -1159,9 +1164,8 @@ int __l2cap_wait_ack(struct sock *sk)
         int timeo = HZ/5;
 
         add_wait_queue(sk_sleep(sk), &wait);
-        while ((chan->unacked_frames > 0 && chan->conn)) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
+        set_current_state(TASK_INTERRUPTIBLE);
+        while (chan->unacked_frames > 0 && chan->conn) {
                 if (!timeo)
                         timeo = HZ/5;
 
@@ -1173,6 +1177,7 @@ int __l2cap_wait_ack(struct sock *sk)
                 release_sock(sk);
                 timeo = schedule_timeout(timeo);
                 lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 err = sock_error(sk);
                 if (err)
@@ -1240,7 +1245,7 @@ static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
                 __clear_retrans_timer(chan);
 }
 
-void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
+static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 {
         struct hci_conn *hcon = chan->conn->hcon;
         u16 flags;
@@ -1256,7 +1261,7 @@ void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
         hci_send_acl(hcon, skb, flags);
 }
 
-void l2cap_streaming_send(struct l2cap_chan *chan)
+static void l2cap_streaming_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb;
         u16 control, fcs;
@@ -1322,7 +1327,7 @@ static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq)
         l2cap_do_send(chan, tx_skb);
 }
 
-int l2cap_ertm_send(struct l2cap_chan *chan)
+static int l2cap_ertm_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb, *tx_skb;
         u16 control, fcs;
@@ -1460,7 +1465,7 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
         return sent;
 }
 
-struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
         struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
@@ -1490,7 +1495,7 @@ struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr
         return skb;
 }
 
-struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
         struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
@@ -1519,7 +1524,9 @@ struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *m
         return skb;
 }
 
-struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
+static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
+                                                struct msghdr *msg, size_t len,
+                                                u16 control, u16 sdulen)
 {
         struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
@@ -1565,7 +1572,7 @@ struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *
         return skb;
 }
 
-int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
         struct sk_buff *skb;
         struct sk_buff_head sar_queue;
@@ -2481,7 +2488,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 if (sock_owned_by_user(sk)) {
                         l2cap_state_change(chan, BT_DISCONN);
                         __clear_chan_timer(chan);
-                        __set_chan_timer(chan, HZ / 5);
+                        __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                         break;
                 }
 
@@ -2654,7 +2661,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         default:
                 sk->sk_err = ECONNRESET;
-                __set_chan_timer(chan, HZ * 5);
+                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -2711,7 +2718,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         if (sock_owned_by_user(sk)) {
                 l2cap_state_change(chan, BT_DISCONN);
                 __clear_chan_timer(chan);
-                __set_chan_timer(chan, HZ / 5);
+                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                 bh_unlock_sock(sk);
                 return 0;
         }
@@ -2745,7 +2752,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
         if (sock_owned_by_user(sk)) {
                 l2cap_state_change(chan,BT_DISCONN);
                 __clear_chan_timer(chan);
-                __set_chan_timer(chan, HZ / 5);
+                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                 bh_unlock_sock(sk);
                 return 0;
         }
@@ -3121,102 +3128,104 @@ static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb,
         return 0;
 }
 
-static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+static void append_skb_frag(struct sk_buff *skb,
+                        struct sk_buff *new_frag, struct sk_buff **last_frag)
 {
-        struct sk_buff *_skb;
-        int err;
+        /* skb->len reflects data in skb as well as all fragments
+         * skb->data_len reflects only data in fragments
+         */
+        if (!skb_has_frag_list(skb))
+                skb_shinfo(skb)->frag_list = new_frag;
+
+        new_frag->next = NULL;
+
+        (*last_frag)->next = new_frag;
+        *last_frag = new_frag;
+
+        skb->len += new_frag->len;
+        skb->data_len += new_frag->len;
+        skb->truesize += new_frag->truesize;
+}
+
+static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+{
+        int err = -EINVAL;
 
         switch (control & L2CAP_CTRL_SAR) {
         case L2CAP_SDU_UNSEGMENTED:
-                if (test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        goto drop;
+                if (chan->sdu)
+                        break;
 
-                return chan->ops->recv(chan->data, skb);
+                err = chan->ops->recv(chan->data, skb);
+                break;
 
         case L2CAP_SDU_START:
-                if (test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        goto drop;
+                if (chan->sdu)
+                        break;
 
                 chan->sdu_len = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
 
-                if (chan->sdu_len > chan->imtu)
-                        goto disconnect;
-
-                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
-                if (!chan->sdu)
-                        return -ENOMEM;
+                if (chan->sdu_len > chan->imtu) {
+                        err = -EMSGSIZE;
+                        break;
+                }
 
-                /* pull sdu_len bytes only after alloc, because of Local Busy
-                 * condition we have to be sure that this will be executed
-                 * only once, i.e., when alloc does not fail */
-                skb_pull(skb, 2);
+                if (skb->len >= chan->sdu_len)
+                        break;
 
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+                chan->sdu = skb;
+                chan->sdu_last_frag = skb;
 
-                set_bit(CONN_SAR_SDU, &chan->conn_state);
-                chan->partial_sdu_len = skb->len;
+                skb = NULL;
+                err = 0;
                 break;
 
         case L2CAP_SDU_CONTINUE:
-                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        goto disconnect;
-
                 if (!chan->sdu)
-                        goto disconnect;
+                        break;
 
-                chan->partial_sdu_len += skb->len;
-                if (chan->partial_sdu_len > chan->sdu_len)
-                        goto drop;
+                append_skb_frag(chan->sdu, skb,
+                                &chan->sdu_last_frag);
+                skb = NULL;
 
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+                if (chan->sdu->len >= chan->sdu_len)
+                        break;
 
+                err = 0;
                 break;
 
         case L2CAP_SDU_END:
-                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        goto disconnect;
-
                 if (!chan->sdu)
-                        goto disconnect;
-
-                chan->partial_sdu_len += skb->len;
+                        break;
 
-                if (chan->partial_sdu_len > chan->imtu)
-                        goto drop;
+                append_skb_frag(chan->sdu, skb,
+                                &chan->sdu_last_frag);
+                skb = NULL;
 
-                if (chan->partial_sdu_len != chan->sdu_len)
-                        goto drop;
+                if (chan->sdu->len != chan->sdu_len)
+                        break;
 
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+                err = chan->ops->recv(chan->data, chan->sdu);
 
-                _skb = skb_clone(chan->sdu, GFP_ATOMIC);
-                if (!_skb) {
-                        return -ENOMEM;
+                if (!err) {
+                        /* Reassembly complete */
+                        chan->sdu = NULL;
+                        chan->sdu_last_frag = NULL;
+                        chan->sdu_len = 0;
                 }
-
-                err = chan->ops->recv(chan->data, _skb);
-                if (err < 0) {
-                        kfree_skb(_skb);
-                        return err;
-                }
-
-                clear_bit(CONN_SAR_SDU, &chan->conn_state);
-
-                kfree_skb(chan->sdu);
                 break;
         }
 
-        kfree_skb(skb);
-        return 0;
-
-drop:
-        kfree_skb(chan->sdu);
-        chan->sdu = NULL;
+        if (err) {
+                kfree_skb(skb);
+                kfree_skb(chan->sdu);
+                chan->sdu = NULL;
+                chan->sdu_last_frag = NULL;
+                chan->sdu_len = 0;
+        }
 
-disconnect:
-        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-        kfree_skb(skb);
-        return 0;
+        return err;
 }
 
 static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
@@ -3270,99 +3279,6 @@ void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
         }
 }
 
-static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
-{
-        struct sk_buff *_skb;
-        int err = -EINVAL;
-
-        /*
-         * TODO: We have to notify the userland if some data is lost with the
-         * Streaming Mode.
-         */
-
-        switch (control & L2CAP_CTRL_SAR) {
-        case L2CAP_SDU_UNSEGMENTED:
-                if (test_bit(CONN_SAR_SDU, &chan->conn_state)) {
-                        kfree_skb(chan->sdu);
-                        break;
-                }
-
-                err = chan->ops->recv(chan->data, skb);
-                if (!err)
-                        return 0;
-
-                break;
-
-        case L2CAP_SDU_START:
-                if (test_bit(CONN_SAR_SDU, &chan->conn_state)) {
-                        kfree_skb(chan->sdu);
-                        break;
-                }
-
-                chan->sdu_len = get_unaligned_le16(skb->data);
-                skb_pull(skb, 2);
-
-                if (chan->sdu_len > chan->imtu) {
-                        err = -EMSGSIZE;
-                        break;
-                }
-
-                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
-                if (!chan->sdu) {
-                        err = -ENOMEM;
-                        break;
-                }
-
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
-
-                set_bit(CONN_SAR_SDU, &chan->conn_state);
-                chan->partial_sdu_len = skb->len;
-                err = 0;
-                break;
-
-        case L2CAP_SDU_CONTINUE:
-                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        break;
-
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
-
-                chan->partial_sdu_len += skb->len;
-                if (chan->partial_sdu_len > chan->sdu_len)
-                        kfree_skb(chan->sdu);
-                else
-                        err = 0;
-
-                break;
-
-        case L2CAP_SDU_END:
-                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
-                        break;
-
-                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
-
-                clear_bit(CONN_SAR_SDU, &chan->conn_state);
-                chan->partial_sdu_len += skb->len;
-
-                if (chan->partial_sdu_len > chan->imtu)
-                        goto drop;
-
-                if (chan->partial_sdu_len == chan->sdu_len) {
-                        _skb = skb_clone(chan->sdu, GFP_ATOMIC);
-                        err = chan->ops->recv(chan->data, _skb);
-                        if (err < 0)
-                                kfree_skb(_skb);
-                }
-                err = 0;
-
-drop:
-                kfree_skb(chan->sdu);
-                break;
-        }
-
-        kfree_skb(skb);
-        return err;
-}
-
 static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
 {
         struct sk_buff *skb;
@@ -3377,7 +3293,7 @@ static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
 
                 skb = skb_dequeue(&chan->srej_q);
                 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                err = l2cap_ertm_reassembly_sdu(chan, skb, control);
+                err = l2cap_reassemble_sdu(chan, skb, control);
 
                 if (err < 0) {
                         l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
@@ -3537,7 +3453,7 @@ expected:
                 return 0;
         }
 
-        err = l2cap_ertm_reassembly_sdu(chan, skb, rx_control);
+        err = l2cap_reassemble_sdu(chan, skb, rx_control);
         chan->buffer_seq = (chan->buffer_seq + 1) % 64;
         if (err < 0) {
                 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
@@ -3853,12 +3769,20 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
 
                 tx_seq = __get_txseq(control);
 
-                if (chan->expected_tx_seq == tx_seq)
-                        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
-                else
-                        chan->expected_tx_seq = (tx_seq + 1) % 64;
+                if (chan->expected_tx_seq != tx_seq) {
+                        /* Frame(s) missing - must discard partial SDU */
+                        kfree_skb(chan->sdu);
+                        chan->sdu = NULL;
+                        chan->sdu_last_frag = NULL;
+                        chan->sdu_len = 0;
+
+                        /* TODO: Notify userland of missing data */
+                }
+
+                chan->expected_tx_seq = (tx_seq + 1) % 64;
 
-                l2cap_streaming_reassembly_sdu(chan, skb, control);
+                if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
 
                 goto done;
 
@@ -4074,7 +3998,7 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         __clear_chan_timer(chan);
-                        __set_chan_timer(chan, HZ * 5);
+                        __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
@@ -4093,6 +4017,11 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
         BT_DBG("conn %p", conn);
 
+        if (hcon->type == LE_LINK) {
+                smp_distribute_keys(conn, 0);
+                del_timer(&conn->security_timer);
+        }
+
         read_lock(&conn->chan_lock);
 
         list_for_each_entry(chan, &conn->chan_l, list) {
@@ -4105,9 +4034,7 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                 if (chan->scid == L2CAP_CID_LE_DATA) {
                         if (!status && encrypt) {
                                 chan->sec_level = hcon->sec_level;
-                                del_timer(&conn->security_timer);
                                 l2cap_chan_ready(sk);
-                                smp_distribute_keys(conn, 0);
                         }
 
                         bh_unlock_sock(sk);
@@ -4139,7 +4066,7 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
                                 __clear_chan_timer(chan);
-                                __set_chan_timer(chan, HZ / 10);
+                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                         }
                 } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
@@ -4159,7 +4086,7 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 }
                         } else {
                                 l2cap_state_change(chan, BT_DISCONN);
-                                __set_chan_timer(chan, HZ / 10);
+                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }