kernel/git/stable/linux.git/net/bluetooth/amp.c, branch linux-4.4.y

Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data

2021-03-07T10:24:21+00:00

[ Upstream commit e8bd76ede155fd54d8c41d045dda43cd3174d506 ] kernel panic trace looks like: #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7 #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe [exception RIP: amp_read_loc_assoc_final_data+63] RIP: ffffffffc06ab54f RSP: ffffb9e08698fd68 RFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8c8845a5a000 RCX: 0000000000000004 RDX: 0000000000000000 RSI: ffff8c8b9153d000 RDI: ffff8c8845a5a000 RBP: ffffb9e08698fe40 R8: 00000000000330e0 R9: ffffffffc0675c94 R10: ffffb9e08698fe58 R11: 0000000000000001 R12: ffff8c8b9cbf6200 R13: 0000000000000000 R14: 0000000000000000 R15: ffff8c8b2026da0b ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth] #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth] #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7 hcon->amp_mgr seems NULL triggered kernel panic in following line inside function amp_read_loc_assoc_final_data set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state); Fixed by checking NULL for mgr. Signed-off-by: Gopal Tiwari Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin

Bluetooth: Fix breakage in amp_write_rem_assoc_frag()

2015-08-10T18:41:34+00:00

We should be passing the pointer itself instead of the address of the pointer. This was a copy and paste bug when we replaced the calls to hci_send_cmd(). Originally, the arguments were "len, cp" but we overwrote them with "sizeof(cp), &cp" by mistake. Fixes: b3d3914006a0 ('Bluetooth: Move amp assoc read/write completed callback to amp.c') Signed-off-by: Dan Carpenter Signed-off-by: Marcel Holtmann

Bluetooth: Move create/accept phy link completed callback to amp.c

2015-07-30T11:37:22+00:00

To avoid amp module hooks from hci_event.c Signed-off-by: Arron Wang Signed-off-by: Marcel Holtmann

Bluetooth: Move amp assoc read/write completed callback to amp.c

2015-07-30T11:37:22+00:00

To avoid amp module hooks from hci_event.c Signed-off-by: Arron Wang Signed-off-by: Marcel Holtmann

Bluetooth: Fix sparse warning in amp.c

2014-11-10T23:07:29+00:00

This fixes the following sparse warning: net/bluetooth/amp.c:152:53: warning: Variable length array is used. The warning itself is probably harmless since this kind of usage of shash_desc is present also in other places in the kernel (there's even a convenience macro SHASH_DESC_ON_STACK available for defining such stack variables). However, dynamically allocated versions are also used in several places of the kernel (e.g. kernel/kexec.c and lib/digsig.c) which have the benefit of not exhibiting the sparse warning. Since there are no more sparse warnings in the Bluetooth subsystem after fixing this one it is now easier to spot whenever new ones might get introduced by future patches. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann

Bluetooth: LLVMLinux: Remove VLAIS from bluetooth/amp.c

2014-09-08T17:07:56+00:00

Replaced the use of a Variable Length Array In Struct (VLAIS) with a C99 compliant equivalent. This patch allocates the appropriate amount of memory using an char array. The new code can be compiled with both gcc and clang. struct shash_desc contains a flexible array member member ctx declared with CRYPTO_MINALIGN_ATTR, so sizeof(struct shash_desc) aligns the beginning of the array declared after struct shash_desc with long long. No trailing padding is required because it is not a struct type that can be used in an array. The CRYPTO_MINALIGN_ATTR is required so that desc is aligned with long long as would be the case for a struct containing a member with CRYPTO_MINALIGN_ATTR. Signed-off-by: Behan Webster Signed-off-by: Mark Charlebois Signed-off-by: Jan-Simon Möller Signed-off-by: Marcel Holtmann

Bluetooth: Remove unneeded variable assignment in hmac_sha256

2014-07-20T16:53:11+00:00

The variable ret does not need to be assigned when declaring it. So remove this initial assignment. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

Bluetooth: Add a role parameter to hci_conn_add()

2014-07-16T09:58:03+00:00

We need to be able to track slave vs master LE connections in hci_conn_hash, and to be able to do that we need to know the role of the connection by the time hci_conn_add_has() is called. This means in practice the hci_conn_add() call that creates the hci_conn_object. This patch adds a new role parameter to hci_conn_add() function to give the object its initial role value, and updates the callers to pass the appropriate role to it. Since the function now takes care of initializing both conn->role and conn->out values we can remove some other unnecessary assignments. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann

Bluetooth: Remove l2cap_conn->dst usage from AMP manager

2013-10-13T14:43:32+00:00

The l2cap_conn->dst address is just a pointer into the hci_conn->dst structure. Use hci_conn->dst directly instead. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

Bluetooth: Move a2mp.h header file into net/bluetooth/

2013-10-10T22:10:05+00:00

The a2mp.h header file is only used internally by the bluetooth.ko module and is not a public API. So make it local to the core Bluetooth module. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg