Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

5 files changed, 37 insertions, 10 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 65f094845719..bb94e6da223c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -57,6 +57,7 @@
 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 {
         __u8 status;
+        struct hci_conn *pend;
 
         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 
@@ -71,6 +72,15 @@ static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
                         clear_bit(HCI_INQUIRY, &hdev->flags);
                         hci_req_complete(hdev, status);
                 }
+
+                hci_dev_lock(hdev);
+
+                pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+                if (pend)
+                        hci_acl_connect(pend);
+
+                hci_dev_unlock(hdev);
+
                 break;
 
         default:
@@ -565,11 +575,20 @@ static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
+        struct hci_conn *pend;
 
         BT_DBG("%s status %d", hdev->name, status);
 
         clear_bit(HCI_INQUIRY, &hdev->flags);
         hci_req_complete(hdev, status);
+
+        hci_dev_lock(hdev);
+
+        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (pend)
+                hci_acl_connect(pend);
+
+        hci_dev_unlock(hdev);
 }
 
 /* Inquiry Result */
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index f26a9eb49945..711a085eca5b 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -120,10 +120,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                         if (!hci_test_bit(evt, &flt->event_mask))
                                 continue;
 
-                        if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
-                                        flt->opcode != *(__u16 *)(skb->data + 3)) ||
-                                        (evt == HCI_EV_CMD_STATUS && 
-                                        flt->opcode != *(__u16 *)(skb->data + 4))))
+                        if (flt->opcode &&
+                            ((evt == HCI_EV_CMD_COMPLETE &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 3))) ||
+                             (evt == HCI_EV_CMD_STATUS &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 4)))))
                                 continue;
                 }
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 954eb74eb370..3eeeb7a86e75 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -259,7 +259,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        conn->dev.parent  = &hdev->dev;
+        conn->dev.bus = &bt_bus;
+        conn->dev.parent = &hdev->dev;
+
         conn->dev.release = bt_release;
 
         snprintf(conn->dev.bus_id, BUS_ID_SIZE,
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 2b3dcb8f90fa..bbf78e6a7bc3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1353,12 +1353,12 @@ static inline int l2cap_conf_output(struct sock *sk, void **ptr)
 
         /* Configure output options and let the other side know
          * which ones we don't like. */
-        if (pi->conf_mtu < pi->omtu) {
-                l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+        if (pi->conf_mtu < pi->omtu)
                 result = L2CAP_CONF_UNACCEPT;
-        } else {
+        else
                 pi->omtu = pi->conf_mtu;
-        }
+
+        l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
         BT_DBG("sk %p result %d", sk, result);
         return result;
@@ -1533,6 +1533,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
                 return -ENOENT;
 
+        if (sk->sk_state == BT_DISCONN)
+                goto unlock;
+
         l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
 
         if (flags & 0x0001) {
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b8e3a5f1c8a8..1fb5d42f37ae 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -765,7 +765,7 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
 
         BT_DBG("tty %p termios %p", tty, old);
 
-        if (!dev)
+        if (!dev || !dev->dlc || !dev->dlc->session)
                 return;
 
         /* Handle turning off CRTSCTS */