1. Mar 19, 2022
    • Dan Carpenter's avatar
      Bluetooth: btmtkuart: fix error handling in mtk_hci_wmt_sync() · a76d269a
      Dan Carpenter authored
      
      
      This code has an uninitialized variable warning:
      
          drivers/bluetooth/btmtkuart.c:184 mtk_hci_wmt_sync()
          error: uninitialized symbol 'wc'.
      
      But it also has error paths which have memory leaks.
      
      Fixes: 8f550f55b155 ("Bluetooth: btmtkuart: rely on BT_MTK module")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      a76d269a
    • Niels Dossche's avatar
      Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed · 9fa6b4cd
      Niels Dossche authored
      hci_le_conn_failed function's documentation says that the caller must
      hold hdev->lock. The only callsite that does not hold that lock is
      hci_le_conn_failed. The other 3 callsites hold the hdev->lock very
      locally. The solution is to hold the lock during the call to
      hci_le_conn_failed.
      
      Fixes: 3c857757
      
       ("Bluetooth: Add directed advertising support through connect()")
      Signed-off-by: default avatarNiels Dossche <dossche.niels@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      9fa6b4cd
    • Manish Mandlik's avatar
      Bluetooth: Send AdvMonitor Dev Found for all matched devices · ff39fc1b
      Manish Mandlik authored
      
      
      When an Advertisement Monitor is configured with SamplingPeriod 0xFF,
      the controller reports only one adv report along with the MSFT Monitor
      Device event.
      
      When an advertiser matches multiple monitors, some controllers send one
      adv report for each matched monitor; whereas, some controllers send just
      one adv report for all matched monitors.
      
      In such a case, report Adv Monitor Device Found event for each matched
      monitor.
      
      Signed-off-by: default avatarManish Mandlik <mmandlik@google.com>
      Reviewed-by: default avatarMiao-chen Chou <mcchou@chromium.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      ff39fc1b
    • Manish Mandlik's avatar
      Bluetooth: msft: Clear tracked devices on resume · 37b63c68
      Manish Mandlik authored
      
      
      Clear already tracked devices on system resume. Once the monitors are
      reregistered after resume, matched devices in range will be found again.
      
      Signed-off-by: default avatarManish Mandlik <mmandlik@google.com>
      Reviewed-by: default avatarMiao-chen Chou <mcchou@chromium.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      37b63c68
    • Gavin Li's avatar
      Bluetooth: fix incorrect nonblock bitmask in bt_sock_wait_ready() · da891217
      Gavin Li authored
      
      
      Callers pass msg->msg_flags as flags, which contains MSG_DONTWAIT
      instead of O_NONBLOCK.
      
      Signed-off-by: default avatarGavin Li <gavin@matician.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      da891217
    • Christophe JAILLET's avatar
      Bluetooth: Don't assign twice the same value · 1f667e15
      Christophe JAILLET authored
      
      
      data.pid is set twice with the same value. Remove one of these redundant
      calls.
      
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1f667e15
    • Max Chou's avatar
      Bluetooth: btrtl: Add support for RTL8852B · 18e8055c
      Max Chou authored
      
      
      Add the support for RTL8852B BT controller on USB interface.
      The necessary firmware file will be submitted to linux-firmware.
      
      Signed-off-by: default avatarMax Chou <max.chou@realtek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      18e8055c
    • Pavel Skripkin's avatar
      Bluetooth: hci_uart: add missing NULL check in h5_enqueue · 32cb08e9
      Pavel Skripkin authored
      
      
      Syzbot hit general protection fault in __pm_runtime_resume(). The problem
      was in missing NULL check.
      
      hu->serdev can be NULL and we should not blindly pass &serdev->dev
      somewhere, since it will cause GPF.
      
      Reported-by: default avatar <syzbot+b9bd12fbed3485a3e51f@syzkaller.appspotmail.com>
      Fixes: d9dd833c
      
       ("Bluetooth: hci_h5: Add runtime suspend")
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      32cb08e9
    • Luiz Augusto von Dentz's avatar
      Bluetooth: Fix use after free in hci_send_acl · f63d24ba
      Luiz Augusto von Dentz authored
      
      
      This fixes the following trace caused by receiving
      HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without
      first checking if conn->type is in fact AMP_LINK and in case it is
      do properly cleanup upper layers with hci_disconn_cfm:
      
       ==================================================================
          BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50
          Read of size 8 at addr ffff88800e404818 by task bluetoothd/142
      
          CPU: 0 PID: 142 Comm: bluetoothd Not tainted
          5.17.0-rc5-00006-gda4022eeac1a #7
          Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
          rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
          Call Trace:
           <TASK>
           dump_stack_lvl+0x45/0x59
           print_address_description.constprop.0+0x1f/0x150
           kasan_report.cold+0x7f/0x11b
           hci_send_acl+0xaba/0xc50
           l2cap_do_send+0x23f/0x3d0
           l2cap_chan_send+0xc06/0x2cc0
           l2cap_sock_sendmsg+0x201/0x2b0
           sock_sendmsg+0xdc/0x110
           sock_write_iter+0x20f/0x370
           do_iter_readv_writev+0x343/0x690
           do_iter_write+0x132/0x640
           vfs_writev+0x198/0x570
           do_writev+0x202/0x280
           do_syscall_64+0x38/0x90
           entry_SYSCALL_64_after_hwframe+0x44/0xae
          RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
          Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3
          0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05
          <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
          RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015
          RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77
          R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580
          RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001
          </TASK>
          R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0
      
          Allocated by task 45:
              kasan_save_stack+0x1e/0x40
              __kasan_kmalloc+0x81/0xa0
              hci_chan_create+0x9a/0x2f0
              l2cap_conn_add.part.0+0x1a/0xdc0
              l2cap_connect_cfm+0x236/0x1000
              le_conn_complete_evt+0x15a7/0x1db0
              hci_le_conn_complete_evt+0x226/0x2c0
              hci_le_meta_evt+0x247/0x450
              hci_event_packet+0x61b/0xe90
              hci_rx_work+0x4d5/0xc50
              process_one_work+0x8fb/0x15a0
              worker_thread+0x576/0x1240
              kthread+0x29d/0x340
              ret_from_fork+0x1f/0x30
      
          Freed by task 45:
              kasan_save_stack+0x1e/0x40
              kasan_set_track+0x21/0x30
              kasan_set_free_info+0x20/0x30
              __kasan_slab_free+0xfb/0x130
              kfree+0xac/0x350
              hci_conn_cleanup+0x101/0x6a0
              hci_conn_del+0x27e/0x6c0
              hci_disconn_phylink_complete_evt+0xe0/0x120
              hci_event_packet+0x812/0xe90
              hci_rx_work+0x4d5/0xc50
              process_one_work+0x8fb/0x15a0
              worker_thread+0x576/0x1240
              kthread+0x29d/0x340
              ret_from_fork+0x1f/0x30
      
          The buggy address belongs to the object at ffff88800c0f0500
          The buggy address is located 24 bytes inside of
          which belongs to the cache kmalloc-128 of size 128
          The buggy address belongs to the page:
          128-byte region [ffff88800c0f0500, ffff88800c0f0580)
          flags: 0x100000000000200(slab|node=0|zone=1)
          page:00000000fe45cd86 refcount:1 mapcount:0
          mapping:0000000000000000 index:0x0 pfn:0xc0f0
          raw: 0000000000000000 0000000080100010 00000001ffffffff
          0000000000000000
          raw: 0100000000000200 ffffea00003a2c80 dead000000000004
          ffff8880078418c0
          page dumped because: kasan: bad access detected
          ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
          Memory state around the buggy address:
          >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
          ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
          ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                      ^
          ==================================================================
          ffff88800c0f0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      Reported-by: default avatarSönke Huster <soenke.huster@eknoes.de>
      Tested-by: default avatarSönke Huster <soenke.huster@eknoes.de>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      f63d24ba
    • Ismael Ferreras Morezuelas's avatar
      Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR controllers · b3cf94c8
      Ismael Ferreras Morezuelas authored
      Another subset of the more recent batch of Chinese clones aren't
      specs-compliant and seem to lock up whenever they receive a
      HCI_OP_SET_EVENT_FLT with flt_type set to zero/HCI_FLT_CLEAR_ALL,
      which on Linux (until the recent HCI state-machine refactor) happened
      right at BR/EDR setup. As there are other less-straightforward ways
      of reaching those operations, this patch is still relevant.
      
      So, while all the previous efforts to wrangle the herd of fake CSRs
      seem to be paying off (and these also get detected as such) we
      still need to take care of this quirk; testers seem to agree
      that these dongles tend to work well enough afterwards.
      
      From some cursory USB packet capture on Windows it seems like
      that driver doesn't appear to use this clear-all functionality at all.
      
      This patch was tested on some really popular AliExpress-style
      dongles, in my case marked as "V5.0". Chip markings: UG8413,
      the backside of the PCB says "USB Dangel" (sic).
      
      Here is the `hciconfig -a` output; for completeness:
      
      hci0:	Type: Primary  Bus: USB
      	BD Address: 00:1A:7D:DA:7X:XX  ACL MTU: 679:8  SCO MTU: 48:16
      	UP RUNNING PSCAN ISCAN
      	Features: 0xbf 0x3e 0x4d 0xfa 0xdb 0x3d 0x7b 0xc7
      	Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
      	Link policy: RSWITCH SNIFF
      	Link mode: PERIPHERAL ACCEPT
      	Name: 'CSR8510 A10.'
      	Class: 0x7c0104
      	Service Classes: Rendering, Capturing, Object Transfer, Audio, Telephony
      	Device Class: Computer, Desktop workstation
      	HCI Version: 4.0 (0x6)  Revision: 0x3120
      	LMP Version: 4.0 (0x6)  Subversion: 0x22bb
      	Manufacturer: Cambridge Silicon Radio (10)
      
      As well as the `lsusb -vv -d 0a12:0001`:
      
      ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.00
        bDeviceClass          224 Wireless
        bDeviceSubClass         1 Radio Frequency
        bDeviceProtocol         1 Bluetooth
        bMaxPacketSize0        64
        idVendor           0x0a12 Cambridge Silicon Radio, Ltd
        idProduct          0x0001 Bluetooth Dongle (HCI mode)
        bcdDevice           88.91
        iManufacturer           0
        iProduct                2 BT DONGLE10
        iSerial                 0
        bNumConfigurations      1
      
      Also, changed the benign dmesg print that shows up whenever the
      generic force-suspend fails from bt_dev_err to bt_dev_warn;
      it's okay and done on a best-effort basis, not a problem
      if that does not work.
      
      Also, swapped the HCI subver and LMP subver numbers for the Barrot
      in the comment, which I copied wrong the last time around.
      
      Fixes: 81cac64b ("Bluetooth: Deal with USB devices that are faking CSR vendor")
      Fixes: cde1a8a9 ("Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers")
      Fixes: d74e0ae7 ("Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134")
      Fixes: 0671c066 ("Bluetooth: btusb: Add workaround for remote-wakeup issues with Barrot 8041a02 fake CSR controllers")
      Fixes: f4292e2f ("Bluetooth: btusb: Make the CSR clone chip force-suspend workaround more generic")
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=60824
      Link: https://gist.github.com/nevack/6b36b82d715dc025163d9e9124840a07
      
      
      
      Cc: stable@vger.kernel.org
      Cc: Hans de Goede <hdegoede@redhat.com>
      Tested-by: default avatarGonzalo Tornaría <tornaria@cmat.edu.uy>
      Tested-by: default avatarMateus Lemos <lemonsmateus@gmail.com>
      Tested-by: default avatarIsmael Ferreras Morezuelas <swyterzone@gmail.com>
      Signed-off-by: default avatarIsmael Ferreras Morezuelas <swyterzone@gmail.com>
      Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      b3cf94c8
    • Ismael Ferreras Morezuelas's avatar
      Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL · 0eaecfb2
      Ismael Ferreras Morezuelas authored
      
      
      Some controllers have problems with being sent a command to clear
      all filtering. While the HCI code does not unconditionally
      send a clear-all anymore at BR/EDR setup (after the state machine
      refactor), there might be more ways of hitting these codepaths
      in the future as the kernel develops.
      
      Cc: stable@vger.kernel.org
      Cc: Hans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarIsmael Ferreras Morezuelas <swyterzone@gmail.com>
      Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      0eaecfb2
    • Sean Wang's avatar
      Bluetooth: btmtkuart: fix the conflict between mtk and msft vendor event · 6ac034a7
      Sean Wang authored
      There is a conflict between MediaTek wmt event and msft vendor extension
      logic in the core layer since 145373cb
      
       ("Bluetooth: Add framework for
      Microsoft vendor extension") was introduced because we changed the type of
      mediatek wmt event to the type of msft vendor event in the driver.
      
      But the purpose we reported mediatek event to the core layer is for the
      diagnostic purpose with that we are able to see the full packet trace via
      monitoring socket with btmon. Thus, it is harmless we keep the original
      type of mediatek vendor event here to avoid breaking the msft extension
      function especially they can be supported by Mediatek future devices.
      
      Signed-off-by: default avatarSean Wang <sean.wang@mediatek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      6ac034a7
    • Sean Wang's avatar
      Bluetooth: btmtkuart: add .set_bdaddr support · 3640e7f4
      Sean Wang authored
      
      
      add .set_bdaddr support
      
      Signed-off-by: default avatarSean Wang <sean.wang@mediatek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      3640e7f4
    • Sean Wang's avatar
      Bluetooth: btmtkuart: rely on BT_MTK module · f5c3f989
      Sean Wang authored
      
      
      Rely on btmtk module to reduce duplicated code
      
      Signed-off-by: default avatarSean Wang <sean.wang@mediatek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      f5c3f989
    • Takashi Iwai's avatar
      Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE · cc68a041
      Takashi Iwai authored
      Chicony Electronics BT device with 04f2:b49f seems to be a missing
      entry for Realtek RTL8723BE.
      
      T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#=  4 Spd=12   MxCh= 0
      D:  Ver= 2.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04f2 ProdID=b49f Rev= 2.00
      S:  Manufacturer=Realtek
      S:  Product=Bluetooth Radio
      S:  SerialNumber=00e04c000001
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      
      BugLink: https://bugzilla.opensuse.org/show_bug.cgi?id=1196779
      
      
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      cc68a041
    • Colin Ian King's avatar
      Bluetooth: mgmt: remove redundant assignment to variable cur_len · 0ca8794a
      Colin Ian King authored
      
      
      Variable cur_len is being ininitialized with a value in the start of
      a for-loop but this is never read, it is being re-assigned a new value
      on the first statement in the for-loop.  The initialization is redundant
      and can be removed.
      
      Cleans up clang scan build warning:
      net/bluetooth/mgmt.c:7958:14: warning: Although the value stored to 'cur_len'
      is used in the enclosing expression, the value is never actually read
      from 'cur_len' [deadcode.DeadStores]
      
      Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      0ca8794a
  2. Mar 18, 2022