A remote user can provide a small value for the command size field in
the command header of an l2cap configuration request, resulting in an
integer underflow when subtracting the size of the configuration request
header.  This results in copying a very large amount of data via
memcpy() and destroying the kernel heap.  Check for underflow.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

When authentication completes we shouldn't blindly accept any pending
L2CAP connect requests. If the socket has the defer_setup feature
enabled it should still wait for user space acceptance of the connect
request. The issue only happens for non-SSP connections since with SSP
the L2CAP Connect request may not be sent for non-SDP PSMs before
authentication has completed successfully.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

read_lock() ... read_unlock_bh() is clearly bogus.
This was broken by

commit 23691d75
Author: Gustavo F. Padovan <padovan@profusion.mobi>
Date:   Wed Apr 27 18:26:32 2011 -0300

    Bluetooth: Remove l2cap_sk_list
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

net/bluetooth/l2cap_core.c: In function ‘l2cap_recv_frame’:
net/bluetooth/l2cap_core.c:3758:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3758:15: note: ‘sk’ was declared here
net/bluetooth/l2cap_core.c:3791:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3791:15: note: ‘sk’ was declared here
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

They were added by me while testing and I forgot to remove.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

A new list was added to replace the socket based one. This new list
doesn't depent on sock and then fits better inside l2cap_core.c code.

It also rename l2cap_chan_alloc() to l2cap_chan_create() and
l2cap_chan_free() to l2cap_chan_destroy)
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

When the user doesn't specify a psm we have the choose one for the
channel. Now we do this inside l2cap_add_psm().
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

The intention is to get rid of the l2cap_sk_list usage inside
l2cap_core.c. l2cap_sk_list will soon be replaced by a list that does not
depend on socket usage.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

A new l2cap_chan_free() is added to free the channels.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

There is no need to the socket deal directly with the channel, most of the
time it cares about the channel only.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

In this commit, psm, scid and dcid.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

In this commit, omtu, imtu, flush_to, mode and sport. It also remove the
pi var from l2cap_sock_sendmsg().
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

In this commit all ERTM and Streaming Mode specific vars.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

In this commit sec_level, force_reliable, role_switch and flushable.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

l2cap_chan_connect() is a much better name and reflects what this
functions is doing (or will do once socket dependence is removed from the
core).
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

First move of elements depending on user data.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

If the allocation happens at l2cap_sock_create() will be able to use the
struct l2cap_chan to store channel info that comes from the user via
setsockopt.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

net/bluetooth/l2cap_core.c: In function ‘l2cap_recv_frame’:
net/bluetooth/l2cap_core.c:3612:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3612:15: note: ‘sk’ was declared here

Actually the problem is in the inline function l2cap_data_channel(), we
branch to the label 'done' which tests 'sk' before we set it to anything.

Initialize it to NULL to fix this.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When retrasmitting one frame, only SAR bits in control field should
be kept.
Signed-off-by: NRuiyi Zhang <Ruiyi.zhang@atheros.com>
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

Fix a regression from the L2CAP "rewrite" patches.
Purge the tx_q already happens on l2cap_chan_del() so we don't need it at
l2cap_disconnect_req().
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

l2cap_get_sock_by_scid was changed to not lock the socket anymore, but I
forgot to change all the users of this function.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

Fix an locking issue with the new l2cap_att_channel(). l2cap_att_channel()
was trying to lock a locked socket.
Reported-by: NAnderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

Despite it works, handling through l2cap_data_channel() is wrongs.
That function should handle only connection oriented data.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

tx_q is the queue used by ERTM mode.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

That was unnecessary use of it.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

Change some BT_DBG messages and consequently remove some struct sock
declarations.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of moving all the Channel related operation to struct l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

This is a regression acctually, caused by the first patch series for
creating a formal strcut l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel stuff to l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel stuff to l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

This also triggered a change in l2cap_send_disconn_req() parameters.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel stuff to l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel stuff to l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel stuff to l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As part of the moving channel to stuff to struct l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

This is part of "moving things to l2cap_chan". As one the first move it
triggered a big number of changes in the funcions parameters, basically
changing the struct sock param to struct l2cap_chan.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

Move some channel specific stuff to l2cap_core.c, this will make things
more clear.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

They are also l2cap_chan specific.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

ident is chan property, no need to reside on socket.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>

As we use struct list_head to keep L2CAP channels list the workaround with
del_list is not needed anymore.
Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>