8 files changed, 188 insertions, 101 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 1edfdf4c095b..f6348e078aa4 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -49,7 +49,7 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "2.12"
+#define VERSION "2.13"
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ca8d05245ca0..b7002429f152 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -330,7 +330,7 @@ EXPORT_SYMBOL(hci_get_route);
 
 /* Create SCO or ACL connection.
  * Device _must_ be locked */
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 auth_type)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
@@ -344,8 +344,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
 
         hci_conn_hold(acl);
 
-        if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
+        if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
+                acl->auth_type = auth_type;
                 hci_acl_connect(acl);
+        }
 
         if (type == ACL_LINK)
                 return acl;
@@ -374,6 +376,19 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
 }
 EXPORT_SYMBOL(hci_connect);
 
+/* Check link security requirement */
+int hci_conn_check_link_mode(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
+                                        !(conn->link_mode & HCI_LM_ENCRYPT))
+                return 0;
+
+        return 1;
+}
+EXPORT_SYMBOL(hci_conn_check_link_mode);
+
 /* Authenticate remote device */
 int hci_conn_auth(struct hci_conn *conn)
 {
@@ -381,7 +396,7 @@ int hci_conn_auth(struct hci_conn *conn)
 
         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0) {
                 if (!(conn->auth_type & 0x01)) {
-                        conn->auth_type = HCI_AT_GENERAL_BONDING_MITM;
+                        conn->auth_type |= 0x01;
                         conn->link_mode &= ~HCI_LM_AUTH;
                 }
         }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f5b21cb93699..278a3ace14f6 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -164,6 +164,9 @@ static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *
 {
         int ret;
 
+        if (!test_bit(HCI_UP, &hdev->flags))
+                return -ENETDOWN;
+
         /* Serialize all requests */
         hci_req_lock(hdev);
         ret = __hci_request(hdev, req, opt, timeout);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0e3db289f4be..ad7a553d7713 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1605,14 +1605,11 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
 
                 if (conn->state == BT_CONFIG) {
                         if (!ev->status && hdev->ssp_mode > 0 &&
-                                                        conn->ssp_mode > 0) {
-                                if (conn->out) {
-                                        struct hci_cp_auth_requested cp;
-                                        cp.handle = ev->handle;
-                                        hci_send_cmd(hdev,
-                                                HCI_OP_AUTH_REQUESTED,
+                                        conn->ssp_mode > 0 && conn->out) {
+                                struct hci_cp_auth_requested cp;
+                                cp.handle = ev->handle;
+                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
-                                }
                         } else {
                                 conn->state = BT_CONNECTED;
                                 hci_proto_connect_cfm(conn, ev->status);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 96434d774c84..acdeab3d9807 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -578,7 +578,7 @@ static int hidp_session(void *arg)
         if (session->hid) {
                 if (session->hid->claimed & HID_CLAIMED_INPUT)
                         hidinput_disconnect(session->hid);
-                hid_free_device(session->hid);
+                hid_destroy_device(session->hid);
         }
 
         /* Wakeup user-space polling for socket errors */
@@ -623,9 +623,15 @@ static struct device *hidp_get_device(struct hidp_session *session)
 static int hidp_setup_input(struct hidp_session *session,
                                 struct hidp_connadd_req *req)
 {
-        struct input_dev *input = session->input;
+        struct input_dev *input;
         int i;
 
+        input = input_allocate_device();
+        if (!input)
+                return -ENOMEM;
+
+        session->input = input;
+
         input_set_drvdata(input, session);
 
         input->name = "Bluetooth HID Boot Protocol Device";
@@ -677,67 +683,114 @@ static void hidp_close(struct hid_device *hid)
 {
 }
 
-static const struct {
-        __u16 idVendor;
-        __u16 idProduct;
-        unsigned quirks;
-} hidp_blacklist[] = {
-        /* Apple wireless Mighty Mouse */
-        { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
+static int hidp_parse(struct hid_device *hid)
+{
+        struct hidp_session *session = hid->driver_data;
+        struct hidp_connadd_req *req = session->req;
+        unsigned char *buf;
+        int ret;
 
-        { }     /* Terminating entry */
-};
+        buf = kmalloc(req->rd_size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        if (copy_from_user(buf, req->rd_data, req->rd_size)) {
+                kfree(buf);
+                return -EFAULT;
+        }
+
+        ret = hid_parse_report(session->hid, buf, req->rd_size);
+
+        kfree(buf);
+
+        if (ret)
+                return ret;
+
+        session->req = NULL;
+
+        return 0;
+}
+
+static int hidp_start(struct hid_device *hid)
+{
+        struct hidp_session *session = hid->driver_data;
+        struct hid_report *report;
 
-static void hidp_setup_quirks(struct hid_device *hid)
+        list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
+                        report_list, list)
+                hidp_send_report(session, report);
+
+        list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
+                        report_list, list)
+                hidp_send_report(session, report);
+
+        return 0;
+}
+
+static void hidp_stop(struct hid_device *hid)
 {
-        unsigned int n;
+        struct hidp_session *session = hid->driver_data;
+
+        skb_queue_purge(&session->ctrl_transmit);
+        skb_queue_purge(&session->intr_transmit);
 
-        for (n = 0; hidp_blacklist[n].idVendor; n++)
-                if (hidp_blacklist[n].idVendor == le16_to_cpu(hid->vendor) &&
-                                hidp_blacklist[n].idProduct == le16_to_cpu(hid->product))
-                        hid->quirks = hidp_blacklist[n].quirks;
+        if (hid->claimed & HID_CLAIMED_INPUT)
+                hidinput_disconnect(hid);
+        hid->claimed = 0;
 }
 
-static void hidp_setup_hid(struct hidp_session *session,
+static struct hid_ll_driver hidp_hid_driver = {
+        .parse = hidp_parse,
+        .start = hidp_start,
+        .stop = hidp_stop,
+        .open  = hidp_open,
+        .close = hidp_close,
+        .hidinput_input_event = hidp_hidinput_event,
+};
+
+static int hidp_setup_hid(struct hidp_session *session,
                                 struct hidp_connadd_req *req)
 {
-        struct hid_device *hid = session->hid;
-        struct hid_report *report;
+        struct hid_device *hid;
         bdaddr_t src, dst;
+        int ret;
 
-        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
-        baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
+        hid = hid_allocate_device();
+        if (IS_ERR(hid)) {
+                ret = PTR_ERR(session->hid);
+                goto err;
+        }
 
+        session->hid = hid;
+        session->req = req;
         hid->driver_data = session;
 
-        hid->country = req->country;
+        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
+        baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
 
         hid->bus     = BUS_BLUETOOTH;
         hid->vendor  = req->vendor;
         hid->product = req->product;
         hid->version = req->version;
+        hid->country = req->country;
 
         strncpy(hid->name, req->name, 128);
         strncpy(hid->phys, batostr(&src), 64);
         strncpy(hid->uniq, batostr(&dst), 64);
 
-        hid->dev = hidp_get_device(session);
-
-        hid->hid_open  = hidp_open;
-        hid->hid_close = hidp_close;
-
-        hid->hidinput_input_event = hidp_hidinput_event;
+        hid->dev.parent = hidp_get_device(session);
+        hid->ll_driver = &hidp_hid_driver;
 
-        hidp_setup_quirks(hid);
+        ret = hid_add_device(hid);
+        if (ret)
+                goto err_hid;
 
-        list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
-                hidp_send_report(session, report);
-
-        list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].report_list, list)
-                hidp_send_report(session, report);
-
-        if (hidinput_connect(hid) == 0)
-                hid->claimed |= HID_CLAIMED_INPUT;
+        return 0;
+err_hid:
+        hid_destroy_device(hid);
+        session->hid = NULL;
+err:
+        return ret;
 }
 
 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
@@ -757,38 +810,6 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 
         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 
-        if (req->rd_size > 0) {
-                unsigned char *buf = kmalloc(req->rd_size, GFP_KERNEL);
-
-                if (!buf) {
-                        kfree(session);
-                        return -ENOMEM;
-                }
-
-                if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-                        kfree(buf);
-                        kfree(session);
-                        return -EFAULT;
-                }
-
-                session->hid = hid_parse_report(buf, req->rd_size);
-
-                kfree(buf);
-
-                if (!session->hid) {
-                        kfree(session);
-                        return -EINVAL;
-                }
-        }
-
-        if (!session->hid) {
-                session->input = input_allocate_device();
-                if (!session->input) {
-                        kfree(session);
-                        return -ENOMEM;
-                }
-        }
-
         down_write(&hidp_session_sem);
 
         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
@@ -816,15 +837,18 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
         session->idle_to = req->idle_to;
 
-        if (session->input) {
+        if (req->rd_size > 0) {
+                err = hidp_setup_hid(session, req);
+                if (err && err != -ENODEV)
+                        goto err_skb;
+        }
+
+        if (!session->hid) {
                 err = hidp_setup_input(session, req);
                 if (err < 0)
-                        goto failed;
+                        goto err_skb;
         }
 
-        if (session->hid)
-                hidp_setup_hid(session, req);
-
         __hidp_link_session(session);
 
         hidp_set_timer(session);
@@ -850,17 +874,16 @@ unlink:
 
         __hidp_unlink_session(session);
 
-        if (session->input) {
+        if (session->input)
                 input_unregister_device(session->input);
-                session->input = NULL; /* don't try to free it here */
-        }
-
+        if (session->hid)
+                hid_destroy_device(session->hid);
+err_skb:
+        skb_queue_purge(&session->ctrl_transmit);
+        skb_queue_purge(&session->intr_transmit);
 failed:
         up_write(&hidp_session_sem);
 
-        if (session->hid)
-                hid_free_device(session->hid);
-
         input_free_device(session->input);
         kfree(session);
         return err;
@@ -950,18 +973,43 @@ int hidp_get_conninfo(struct hidp_conninfo *ci)
         return err;
 }
 
+static const struct hid_device_id hidp_table[] = {
+        { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
+        { }
+};
+
+static struct hid_driver hidp_driver = {
+        .name = "generic-bluetooth",
+        .id_table = hidp_table,
+};
+
 static int __init hidp_init(void)
 {
+        int ret;
+
         l2cap_load();
 
         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
 
-        return hidp_init_sockets();
+        ret = hid_register_driver(&hidp_driver);
+        if (ret)
+                goto err;
+
+        ret = hidp_init_sockets();
+        if (ret)
+                goto err_drv;
+
+        return 0;
+err_drv:
+        hid_unregister_driver(&hidp_driver);
+err:
+        return ret;
 }
 
 static void __exit hidp_exit(void)
 {
         hidp_cleanup_sockets();
+        hid_unregister_driver(&hidp_driver);
 }
 
 module_init(hidp_init);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 343fb0566b3e..e503c89057ad 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -151,6 +151,8 @@ struct hidp_session {
 
         struct sk_buff_head ctrl_transmit;
         struct sk_buff_head intr_transmit;
+
+        struct hidp_connadd_req *req;
 };
 
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 3396d5bdef1c..9610a9c85b98 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -55,7 +55,7 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "2.10"
+#define VERSION "2.11"
 
 static u32 l2cap_feat_mask = 0x0000;
 
@@ -778,6 +778,7 @@ static int l2cap_do_connect(struct sock *sk)
         struct l2cap_conn *conn;
         struct hci_conn *hcon;
         struct hci_dev *hdev;
+        __u8 auth_type;
         int err = 0;
 
         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
@@ -789,7 +790,21 @@ static int l2cap_do_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        hcon = hci_connect(hdev, ACL_LINK, dst);
+        if (l2cap_pi(sk)->link_mode & L2CAP_LM_AUTH ||
+                        l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT ||
+                                l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE) {
+                if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001))
+                        auth_type = HCI_AT_NO_BONDING_MITM;
+                else
+                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
+        } else {
+                if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001))
+                        auth_type = HCI_AT_NO_BONDING;
+                else
+                        auth_type = HCI_AT_GENERAL_BONDING;
+        }
+
+        hcon = hci_connect(hdev, ACL_LINK, dst, auth_type);
         if (!hcon)
                 goto done;
 
@@ -1553,10 +1568,10 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
         struct l2cap_conn_rsp rsp;
         struct sock *sk, *parent;
-        int result, status = 0;
+        int result, status = L2CAP_CS_NO_INFO;
 
         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
-        __le16 psm  = req->psm;
+        __le16 psm = req->psm;
 
         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
 
@@ -1567,6 +1582,13 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 goto sendresp;
         }
 
+        /* Check if the ACL is secure enough (if not SDP) */
+        if (psm != cpu_to_le16(0x0001) &&
+                                !hci_conn_check_link_mode(conn->hcon)) {
+                result = L2CAP_CR_SEC_BLOCK;
+                goto response;
+        }
+
         result = L2CAP_CR_NO_MEM;
 
         /* Check for backlog size */
@@ -2224,7 +2246,7 @@ static int l2cap_auth_cfm(struct hci_conn *hcon, u8 status)
                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
                         rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(0);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
                 }
@@ -2296,7 +2318,7 @@ static int l2cap_encrypt_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
                         rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(0);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
                 }
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index a16011fedc1d..0cc91e6da76d 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -200,7 +200,7 @@ static int sco_connect(struct sock *sk)
         else
                 type = SCO_LINK;
 
-        hcon = hci_connect(hdev, type, dst);
+        hcon = hci_connect(hdev, type, dst, HCI_AT_NO_BONDING);
         if (!hcon)
                 goto done;