06 Dec, 2016

1 commit

  • copy_from_iter_full(), copy_from_iter_full_nocache() and
    csum_and_copy_from_iter_full() - counterparts of copy_from_iter()
    et.al., advancing iterator only in case of successful full copy
    and returning whether it had been successful or not.

    Convert some obvious users. *NOTE* - do not blindly assume that
    something is a good candidate for those unless you are sure that
    not advancing iov_iter in failure case is the right thing in
    this case. Anything that does short read/short write kind of
    stuff (or is in a loop, etc.) is unlikely to be a good one.

    Signed-off-by: Al Viro

    Al Viro
     

31 Aug, 2016

1 commit

  • This patch removes module_init()/module_exit() from driver code by using
    module_misc_device() macro. All modules in this patch has a print
    statement which is removed when module_misc_device() macro is used.
    If undesirable this patch can be dropped entirely, this is the only
    purpose of making this as a separate patch.

    Signed-off-by: PrasannaKumar Muralidharan
    Signed-off-by: Greg Kroah-Hartman

    PrasannaKumar Muralidharan
     

10 Jul, 2016

1 commit

  • The HCI_BREDR naming is confusing since it actually stands for Primary
    Bluetooth Controller. Which is a term that has been used in the latest
    standard. However from a legacy point of view there only really have
    been Basic Rate (BR) and Enhanced Data Rate (EDR). Recent versions of
    Bluetooth introduced Low Energy (LE) and made this terminology a little
    bit confused since Dual Mode Controllers include BR/EDR and LE. To
    simplify this the name HCI_PRIMARY stands for the Primary Controller
    which can be a single mode or dual mode controller.

    Signed-off-by: Marcel Holtmann
    Signed-off-by: Johan Hedberg

    Marcel Holtmann
     

20 Apr, 2016

1 commit

  • hci_vhci driver creates a hci device object dynamically upon each
    HCI_VENDOR_PKT write. Although it checks the already created object
    and returns an error, it's still racy and may build multiple hci_dev
    objects concurrently when parallel writes are performed, as the device
    tracks only a single hci_dev object.

    This patch introduces a mutex to protect against the concurrent device
    creations.

    Cc:
    Signed-off-by: Takashi Iwai
    Signed-off-by: Marcel Holtmann

    Takashi Iwai
     

09 Apr, 2016

2 commits

  • The write handler allocates skbs and queues them into data->readq.
    Read side should read them, if there is any. If there is none, skbs
    should be dropped by hdev->flush. But this happens only if the device
    is HCI_UP, i.e. hdev->power_on work was triggered already. When it was
    not, skbs stay allocated in the queue when /dev/vhci is closed. So
    purge the queue in ->release.

    Program to reproduce:
    #include
    #include
    #include
    #include

    #include
    #include
    #include

    int main()
    {
    char buf[] = { 0xff, 0 };
    struct iovec iov = {
    .iov_base = buf,
    .iov_len = sizeof(buf),
    };
    int fd;

    while (1) {
    fd = open("/dev/vhci", O_RDWR);
    if (fd < 0)
    err(1, "open");

    usleep(50);

    if (writev(fd, &iov, 1) < 0)
    err(1, "writev");

    usleep(50);

    close(fd);
    }

    return 0;
    }

    Result:
    kmemleak: 4609 new suspected memory leaks
    unreferenced object 0xffff88059f4d5440 (size 232):
    comm "vhci", pid 1084, jiffies 4294912542 (age 37569.296s)
    hex dump (first 32 bytes):
    20 f0 23 87 05 88 ff ff 20 f0 23 87 05 88 ff ff .#..... .#.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    ...
    [] __alloc_skb+0x0/0x5a0
    [] vhci_create_device+0x5c/0x580 [hci_vhci]
    [] vhci_write+0x306/0x4c8 [hci_vhci]

    Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
    Signed-off-by: Jiri Slaby
    Signed-off-by: Marcel Holtmann
    Cc: stable 3.13+

    Jiri Slaby
     
  • Both vhci_get_user and vhci_release race with open_timeout work. They
    both contain cancel_delayed_work_sync, but do not test whether the
    work actually created hdev or not. Since the work can be in progress
    and _sync will wait for finishing it, we can have data->hdev allocated
    when cancel_delayed_work_sync returns. But the call sites do 'if
    (data->hdev)' *before* cancel_delayed_work_sync.

    As a result:
    * vhci_get_user allocates a second hdev and puts it into
    data->hdev. The former is leaked.
    * vhci_release does not release data->hdev properly as it thinks there
    is none.

    Fix both cases by moving the actual test *after* the call to
    cancel_delayed_work_sync.

    This can be hit by this program:
    #include
    #include
    #include
    #include
    #include
    #include

    #include
    #include

    int main(int argc, char **argv)
    {
    int fd;

    srand(time(NULL));

    while (1) {
    const int delta = (rand() % 200 - 100) * 100;

    fd = open("/dev/vhci", O_RDWR);
    if (fd < 0)
    err(1, "open");

    usleep(1000000 + delta);

    close(fd);
    }

    return 0;
    }

    And the result is:
    BUG: KASAN: use-after-free in skb_queue_tail+0x13e/0x150 at addr ffff88006b0c1228
    Read of size 8 by task kworker/u13:1/32068
    =============================================================================
    BUG kmalloc-192 (Tainted: G E ): kasan: bad access detected
    -----------------------------------------------------------------------------

    Disabling lock debugging due to kernel taint
    INFO: Allocated in vhci_open+0x50/0x330 [hci_vhci] age=260 cpu=3 pid=32040
    ...
    kmem_cache_alloc_trace+0x150/0x190
    vhci_open+0x50/0x330 [hci_vhci]
    misc_open+0x35b/0x4e0
    chrdev_open+0x23b/0x510
    ...
    INFO: Freed in vhci_release+0xa4/0xd0 [hci_vhci] age=9 cpu=2 pid=32040
    ...
    __slab_free+0x204/0x310
    vhci_release+0xa4/0xd0 [hci_vhci]
    ...
    INFO: Slab 0xffffea0001ac3000 objects=16 used=13 fp=0xffff88006b0c1e00 flags=0x5fffff80004080
    INFO: Object 0xffff88006b0c1200 @offset=4608 fp=0xffff88006b0c0600
    Bytes b4 ffff88006b0c11f0: 09 df 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
    Object ffff88006b0c1200: 00 06 0c 6b 00 88 ff ff 00 00 00 00 00 00 00 00 ...k............
    Object ffff88006b0c1210: 10 12 0c 6b 00 88 ff ff 10 12 0c 6b 00 88 ff ff ...k.......k....
    Object ffff88006b0c1220: c0 46 c2 6b 00 88 ff ff c0 46 c2 6b 00 88 ff ff .F.k.....F.k....
    Object ffff88006b0c1230: 01 00 00 00 01 00 00 00 e0 ff ff ff 0f 00 00 00 ................
    Object ffff88006b0c1240: 40 12 0c 6b 00 88 ff ff 40 12 0c 6b 00 88 ff ff @..k....@..k....
    Object ffff88006b0c1250: 50 0d 6e a0 ff ff ff ff 00 02 00 00 00 00 ad de P.n.............
    Object ffff88006b0c1260: 00 00 00 00 00 00 00 00 ab 62 02 00 01 00 00 00 .........b......
    Object ffff88006b0c1270: 90 b9 19 81 ff ff ff ff 38 12 0c 6b 00 88 ff ff ........8..k....
    Object ffff88006b0c1280: 03 00 20 00 ff ff ff ff ff ff ff ff 00 00 00 00 .. .............
    Object ffff88006b0c1290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    Object ffff88006b0c12a0: 00 00 00 00 00 00 00 00 00 80 cd 3d 00 88 ff ff ...........=....
    Object ffff88006b0c12b0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ..............
    Redzone ffff88006b0c12c0: bb bb bb bb bb bb bb bb ........
    Padding ffff88006b0c13f8: 00 00 00 00 00 00 00 00 ........
    CPU: 3 PID: 32068 Comm: kworker/u13:1 Tainted: G B E 4.4.6-0-default #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20151112_172657-sheep25 04/01/2014
    Workqueue: hci0 hci_cmd_work [bluetooth]
    00000000ffffffff ffffffff81926cfa ffff88006be37c68 ffff88006bc27180
    ffff88006b0c1200 ffff88006b0c1234 ffffffff81577993 ffffffff82489320
    ffff88006bc24240 0000000000000046 ffff88006a100000 000000026e51eb80
    Call Trace:
    ...
    [] ? skb_queue_tail+0x13e/0x150
    [] ? vhci_send_frame+0xac/0x100 [hci_vhci]
    [] ? hci_send_frame+0x188/0x320 [bluetooth]
    [] ? hci_cmd_work+0x115/0x310 [bluetooth]
    [] ? process_one_work+0x815/0x1340
    [] ? worker_thread+0xe5/0x11f0
    [] ? process_one_work+0x1340/0x1340
    [] ? kthread+0x1c8/0x230
    ...
    Memory state around the buggy address:
    ffff88006b0c1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ffff88006b0c1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    >ffff88006b0c1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ^
    ffff88006b0c1280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    ffff88006b0c1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

    Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
    Signed-off-by: Jiri Slaby
    Signed-off-by: Marcel Holtmann
    Cc: Dmitry Vyukov
    Cc: stable 3.13+

    Jiri Slaby
     

20 Nov, 2015

1 commit


05 Oct, 2015

2 commits


04 Jun, 2015

1 commit


09 Oct, 2014

1 commit


05 Jul, 2014

1 commit


03 Jul, 2014

1 commit


19 Feb, 2014

1 commit

  • Commit bfacbb9 (Bluetooth: Use devname:vhci module alias for virtual HCI
    driver) added the module alias to hci_vhci module so it's possible to
    create the /dev/vhci node. However creating an alias without
    specifying the minor doesn't allow us to create the node ahead,
    triggerring module auto-load when it's first accessed.

    Starting with depmod from kmod 16 we started to warn if there's a
    devname alias without specifying the major and minor.

    Let's do the same done for uhid, kvm, fuse and others, specifying a
    fixed minor. In systems with systemd as the init the following will
    happen: on early boot systemd will call "kmod static-nodes" to read
    /lib/modules/$(uname -r)/modules.devname and then create the nodes. When
    first accessed these "dead" nodes will trigger the module loading.

    Signed-off-by: Lucas De Marchi
    Acked-by: Greg Kroah-Hartman
    Signed-off-by: Marcel Holtmann

    Lucas De Marchi
     

30 Dec, 2013

1 commit


11 Oct, 2013

3 commits


17 Sep, 2013

2 commits

  • So far the only option to create a virtual AMP controller was by
    setting a module parameter for the hci_vhci driver. This patch adds
    the functionality to define inline to create either a BR/EDR or an
    AMP controller.

    In addition the client will be informed which HCI controller index
    it got assigned. That is especially useful for automated end-to-end
    testing.

    To keep backwards compatibility with existing userspace, the command
    for creating a controller type needs to be send right after opening
    the device node. If the command is not send, it defaults back to
    automatically creating a BR/EDR controller.

    Signed-off-by: Marcel Holtmann
    Signed-off-by: Gustavo Padovan

    Marcel Holtmann
     
  • To allow creating /dev/vhci device node, add the proper module alias for
    this driver.

    Signed-off-by: Marcel Holtmann
    Signed-off-by: Gustavo Padovan

    Marcel Holtmann
     

19 Sep, 2012

1 commit


09 May, 2012

1 commit

  • The comment in ./fs/open.c clearly states that nonseekable_open() will
    never fail. Therefore, we can safely ignore the return code. This is the
    recommended way to deal with nonseekable_open().
    Our current code looks like nonseekable_open() is checked for the return
    code. However, if we check the return code, we must also kfree() our
    private data if the open fails. To avoid this overhead and to avoid
    confusion, we simply drop the return code and return 0.

    Signed-off-by: David Herrmann
    Acked-by: Marcel Holtmann
    Signed-off-by: Johan Hedberg

    David Herrmann
     

13 Feb, 2012

3 commits

  • The linux device model provides dev_set/get_drvdata so we can use this
    to save private driver data.
    This also removes several unnecessary casts.

    Signed-off-by: David Herrmann
    Acked-by: Marcel Holtmann
    Signed-off-by: Johan Hedberg

    David Herrmann
     
  • After unregistering an hci_dev object a bluetooth driver does not have
    any callbacks in the hci_dev structure left over. Therefore, there is no
    need to keep a reference to the module.

    Previously, we needed this to protect the hci-destruct callback.
    However, this callback is no longer available so we do not need this
    owner field, anymore. Drivers now call hci_unregister_dev() and they
    are done with the object.

    Signed-off-by: David Herrmann
    Acked-by: Marcel Holtmann
    Signed-off-by: Johan Hedberg

    David Herrmann
     
  • This removes the hci-destruct callback and instead frees the private
    driver data in the vhci_release file release function. There is no
    reason to keep private driver data available if the driver has already
    shut down.

    After vhci_release is called our module can be unloaded. The only reason
    it is kept alive is the hci-core having a module-ref on us because of
    our destruct callback. However, this callback only frees
    hdev->driver_data. That is, we wait for the hdev-device to get destroyed
    to free our internal driver-data. In fact, the hci-core does never touch
    hdev->driver_data so it doesn't care if it is NULL. Therefore, we simply
    free it when unloading the driver.

    Another important fact is that the hdev core does not call any callbacks
    other than the destruct-cb after hci_unregister_dev() has been called.
    So there is no function of our module that will be called nor does the
    hci-core touch hdev->driver_data. Hence, no other code can touch
    hdev->driver_data after our cleanup so the destruct callback is
    definitely unnecessary here.

    Signed-off-by: David Herrmann
    Acked-by: Marcel Holtmann
    Signed-off-by: Johan Hedberg

    David Herrmann
     

17 Nov, 2011

1 commit


08 Nov, 2011

1 commit

  • Make all bluetooth drivers ignore the return value of hci_unregister_dev as it
    always returns 0. In the next step, hci_unregister_dev can be modified to return
    void.
    Some of the drivers already ignore the return value (including btusb), hence,
    this will increase consitency in the bluetooth drivers.

    Signed-off-by: David Herrmann
    Acked-by: Marcel Holtmann
    Signed-off-by: Gustavo F. Padovan

    David Herrmann
     

15 Oct, 2010

1 commit

  • All file_operations should get a .llseek operation so we can make
    nonseekable_open the default for future file operations without a
    .llseek pointer.

    The three cases that we can automatically detect are no_llseek, seq_lseek
    and default_llseek. For cases where we can we can automatically prove that
    the file offset is always ignored, we use noop_llseek, which maintains
    the current behavior of not returning an error from a seek.

    New drivers should normally not use noop_llseek but instead use no_llseek
    and call nonseekable_open at open time. Existing drivers can be converted
    to do the same when the maintainer knows for certain that no user code
    relies on calling seek on the device file.

    The generated code is often incorrectly indented and right now contains
    comments that clarify for each added line why a specific variant was
    chosen. In the version that gets submitted upstream, the comments will
    be gone and I will manually fix the indentation, because there does not
    seem to be a way to do that using coccinelle.

    Some amount of new code is currently sitting in linux-next that should get
    the same modifications, which I will do at the end of the merge window.

    Many thanks to Julia Lawall for helping me learn to write a semantic
    patch that does all this.

    ===== begin semantic patch =====
    // This adds an llseek= method to all file operations,
    // as a preparation for making no_llseek the default.
    //
    // The rules are
    // - use no_llseek explicitly if we do nonseekable_open
    // - use seq_lseek for sequential files
    // - use default_llseek if we know we access f_pos
    // - use noop_llseek if we know we don't access f_pos,
    // but we still want to allow users to call lseek
    //
    @ open1 exists @
    identifier nested_open;
    @@
    nested_open(...)
    {

    }

    @ open exists@
    identifier open_f;
    identifier i, f;
    identifier open1.nested_open;
    @@
    int open_f(struct inode *i, struct file *f)
    {

    }

    @ read disable optional_qualifier exists @
    identifier read_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    expression E;
    identifier func;
    @@
    ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
    {

    }

    @ read_no_fpos disable optional_qualifier exists @
    identifier read_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    @@
    ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
    {
    ... when != off
    }

    @ write @
    identifier write_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    expression E;
    identifier func;
    @@
    ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
    {

    }

    @ write_no_fpos @
    identifier write_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    @@
    ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
    {
    ... when != off
    }

    @ fops0 @
    identifier fops;
    @@
    struct file_operations fops = {
    ...
    };

    @ has_llseek depends on fops0 @
    identifier fops0.fops;
    identifier llseek_f;
    @@
    struct file_operations fops = {
    ...
    .llseek = llseek_f,
    ...
    };

    @ has_read depends on fops0 @
    identifier fops0.fops;
    identifier read_f;
    @@
    struct file_operations fops = {
    ...
    .read = read_f,
    ...
    };

    @ has_write depends on fops0 @
    identifier fops0.fops;
    identifier write_f;
    @@
    struct file_operations fops = {
    ...
    .write = write_f,
    ...
    };

    @ has_open depends on fops0 @
    identifier fops0.fops;
    identifier open_f;
    @@
    struct file_operations fops = {
    ...
    .open = open_f,
    ...
    };

    // use no_llseek if we call nonseekable_open
    ////////////////////////////////////////////
    @ nonseekable1 depends on !has_llseek && has_open @
    identifier fops0.fops;
    identifier nso ~= "nonseekable_open";
    @@
    struct file_operations fops = {
    ... .open = nso, ...
    +.llseek = no_llseek, /* nonseekable */
    };

    @ nonseekable2 depends on !has_llseek @
    identifier fops0.fops;
    identifier open.open_f;
    @@
    struct file_operations fops = {
    ... .open = open_f, ...
    +.llseek = no_llseek, /* open uses nonseekable */
    };

    // use seq_lseek for sequential files
    /////////////////////////////////////
    @ seq depends on !has_llseek @
    identifier fops0.fops;
    identifier sr ~= "seq_read";
    @@
    struct file_operations fops = {
    ... .read = sr, ...
    +.llseek = seq_lseek, /* we have seq_read */
    };

    // use default_llseek if there is a readdir
    ///////////////////////////////////////////
    @ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier readdir_e;
    @@
    // any other fop is used that changes pos
    struct file_operations fops = {
    ... .readdir = readdir_e, ...
    +.llseek = default_llseek, /* readdir is present */
    };

    // use default_llseek if at least one of read/write touches f_pos
    /////////////////////////////////////////////////////////////////
    @ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read.read_f;
    @@
    // read fops use offset
    struct file_operations fops = {
    ... .read = read_f, ...
    +.llseek = default_llseek, /* read accesses f_pos */
    };

    @ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier write.write_f;
    @@
    // write fops use offset
    struct file_operations fops = {
    ... .write = write_f, ...
    + .llseek = default_llseek, /* write accesses f_pos */
    };

    // Use noop_llseek if neither read nor write accesses f_pos
    ///////////////////////////////////////////////////////////

    @ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read_no_fpos.read_f;
    identifier write_no_fpos.write_f;
    @@
    // write fops use offset
    struct file_operations fops = {
    ...
    .write = write_f,
    .read = read_f,
    ...
    +.llseek = noop_llseek, /* read and write both use no f_pos */
    };

    @ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier write_no_fpos.write_f;
    @@
    struct file_operations fops = {
    ... .write = write_f, ...
    +.llseek = noop_llseek, /* write uses no f_pos */
    };

    @ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read_no_fpos.read_f;
    @@
    struct file_operations fops = {
    ... .read = read_f, ...
    +.llseek = noop_llseek, /* read uses no f_pos */
    };

    @ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    @@
    struct file_operations fops = {
    ...
    +.llseek = noop_llseek, /* no read or write fn */
    };
    ===== End semantic patch =====

    Signed-off-by: Arnd Bergmann
    Cc: Julia Lawall
    Cc: Christoph Hellwig

    Arnd Bergmann
     

10 May, 2010

1 commit


27 Feb, 2010

1 commit


04 Dec, 2009

3 commits


13 Jul, 2009

1 commit

  • * Remove smp_lock.h from files which don't need it (including some headers!)
    * Add smp_lock.h to files which do need it
    * Make smp_lock.h include conditional in hardirq.h
    It's needed only for one kernel_locked() usage which is under CONFIG_PREEMPT

    This will make hardirq.h inclusion cheaper for every PREEMPT=n config
    (which includes allmodconfig/allyesconfig, BTW)

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

08 Jun, 2009

4 commits


30 Nov, 2008

1 commit

  • With the introduction of CONFIG_DYNAMIC_PRINTK_DEBUG it is possible to
    allow debugging without having to recompile the kernel. This patch turns
    all BT_DBG() calls into pr_debug() to support dynamic debug messages.

    As a side effect all CONFIG_BT_*_DEBUG statements are now removed and
    some broken debug entries have been fixed.

    Signed-off-by: Marcel Holtmann

    Marcel Holtmann
     

18 Aug, 2008

1 commit

  • The Bluetooth entries for the MAINTAINERS file are a little bit too
    much. Consolidate them into two entries. One for Bluetooth drivers and
    another one for the Bluetooth subsystem.

    Also the MODULE_AUTHOR should indicate the current maintainer of the
    module and actually not the original author. Fix all Bluetooth modules
    to provide current maintainer information.

    Signed-off-by: Marcel Holtmann

    Marcel Holtmann