[PATCH 3.13.y-ckt 32/86] Bluetooth: hidp: fix device disconnect on idle timeout

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 32/86] Bluetooth: hidp: fix device disconnect on idle timeout
Date	2015-12-03 00:20 +0100
Message-ID	<qBoQP-5n9-45@gated-at.bofh.it> (permalink)
References	<qBoxr-50H-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt31 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Herrmann <dh.herrmann@gmail.com>

commit 660f0fc07d21114549c1862e67e78b1cf0c90c29 upstream.

The HIDP specs define an idle-timeout which automatically disconnects a
device. This has always been implemented in the HIDP layer and forced a
synchronous shutdown of the hidp-scheduler. This works just fine, but
lacks a forced disconnect on the underlying l2cap channels. This has been
broken since:

    commit 5205185d461d5902325e457ca80bd421127b7308
    Author: David Herrmann <dh.herrmann@gmail.com>
    Date:   Sat Apr 6 20:28:47 2013 +0200

        Bluetooth: hidp: remove old session-management

The old session-management always forced an l2cap error on the ctrl/intr
channels when shutting down. The new session-management skips this, as we
don't want to enforce channel policy on the caller. In other words, if
user-space removes an HIDP device, the underlying channels (which are
*owned* and *referenced* by user-space) are still left active. User-space
needs to call shutdown(2) or close(2) to release them.

Unfortunately, this does not work with idle-timeouts. There is no way to
signal user-space that the HIDP layer has been stopped. The API simply
does not support any event-passing except for poll(2). Hence, we restore
old behavior and force EUNATCH on the sockets if the HIDP layer is
disconnected due to idle-timeouts (behavior of explicit disconnects
remains unmodified). User-space can still call

    getsockopt(..., SO_ERROR, ...)

..to retrieve the EUNATCH error and clear sk_err. Hence, the channels can
still be re-used (which nobody does so far, though). Therefore, the API
still supports the new behavior, but with this patch it's also compatible
to the old implicit channel shutdown.

Reported-by: Mark Haun <haunma@keteu.org>
Reported-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/bluetooth/hidp/core.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 292e619..f6ebe25 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -415,6 +415,20 @@ static void hidp_idle_timeout(unsigned long arg)
 {
 	struct hidp_session *session = (struct hidp_session *) arg;
 
+	/* The HIDP user-space API only contains calls to add and remove
+	 * devices. There is no way to forward events of any kind. Therefore,
+	 * we have to forcefully disconnect a device on idle-timeouts. This is
+	 * unfortunate and weird API design, but it is spec-compliant and
+	 * required for backwards-compatibility. Hence, on idle-timeout, we
+	 * signal driver-detach events, so poll() will be woken up with an
+	 * error-condition on both sockets.
+	 */
+
+	session->intr_sock->sk->sk_err = EUNATCH;
+	session->ctrl_sock->sk->sk_err = EUNATCH;
+	wake_up_interruptible(sk_sleep(session->intr_sock->sk));
+	wake_up_interruptible(sk_sleep(session->ctrl_sock->sk));
+
 	hidp_session_terminate(session);
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt31 stable review Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 04/86] drm/radeon: add quirk for ASUS R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 54/86] ALSA: hda - Add Intel Lewisburg device IDs Audio Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 84/86] drm: Fix return value of drm_framebuffer_init() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 74/86] mwifiex: fix mwifiex_rdeeprom_read() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 82/86] packet: fix match_fanout_group() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 61/86] perf: Fix inherited events vs. tracepoint filters Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 76/86] devres: fix a for loop bounds check Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 64/86] storvsc: Don't set the SRB_FLAGS_QUEUE_ACTION_ENABLE flag Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 86/86] TPM: Avoid reference to potentially freed memory Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 14/86] [3.13-stable only] fib_rules: Fix dump_rules() not to exit early Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 71/86] FS-Cache: Handle a write to the page immediately beyond the EOF marker Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 47/86] xtensa: fixes for configs without loop option Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 55/86] firewire: ohci: fix JMicron JMB38x IT context discovery Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 79/86] perf trace: Fix documentation for -i Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 60/86] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 73/86] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 69/86] FS-Cache: Increase reference of parent after registering, netfs success Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 59/86] Btrfs: fix race leading to incorrect item deletion when dropping extents Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 63/86] Btrfs: fix race when listing an inode's xattrs Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 65/86] KVM: x86: Defining missing x86 vectors Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 78/86] ipv6: fix tunnel error handling Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 56/86] proc: actually make proc_fd_permission() thread-friendly Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 66/86] KVM: x86: work around infinite loop in microcode when #AC is delivered Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 57/86] printk: prevent userland from spoofing kernel messages Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 68/86] drm/ast: Initialized data needed to map fbdev memory Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 70/86] FS-Cache: Don't override netfs's primary_index if registering failed Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 81/86] mac80211: fix driver RSSI event calculations Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 62/86] scsi_sysfs: Fix queue_ramp_up_period return code Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 80/86] bonding: fix panic on non-ARPHRD_ETHER enslave failure Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 72/86] binfmt_elf: Don't clobber passed executable's file header Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 58/86] x86/cpu: Call verify_cpu() after having entered long mode too Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 50/86] recordmcount: Fix endianness handling bug for nop_mcount Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 46/86] crypto: algif_hash - Only export and import on sockets with data Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 49/86] mac80211: allow null chandef in tracing Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 34/86] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 40/86] MAINTAINERS: Add public mailing list for ARC Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 38/86] ALSA: hda/realtek - Dell XPS one ALC3260 speaker no sound after resume back Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 44/86] mtd: blkdevs: fix potential deadlock + lockdep warnings Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 12/86] net: avoid NULL deref in inet_ctl_sock_destroy() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 39/86] ALSA: hda - Disable 64bit address for Creative HDA controllers Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 17/86] net: mvneta: Fix CPU_MAP registers initialisation Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 35/86] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 43/86] can: Use correct type in sizeof() in nla_put() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 45/86] Revert "dm mpath: fix stalls when handling invalid ioctls" Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 32/86] Bluetooth: hidp: fix device disconnect on idle timeout Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 41/86] megaraid_sas: Do not use PAGE_SIZE for max_sectors Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 36/86] staging: rtl8712: Add device ID for Sitecom WLA2100 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 31/86] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 42/86] arm64: Fix compat register mappings Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 18/86] mtd: mtdpart: fix add_mtd_partitions error path Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 37/86] ACPI: Use correct IRQ when uninstalling ACPI interrupt handler Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 48/86] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 11/86] qmi_wwan: fix entry for HP lt4112 LTE/HSPA+ Gobi 4G Module Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 53/86] ALSA: hda - Apply pin fixup for HP ProBook 6550b Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 51/86] KVM: Disable SMAP for guests in EPT realmode and EPT unpaging mode Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 52/86] KVM: VMX: fix SMEP and SMAP without EPT Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 13/86] net: fix a race in dst_release() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 06/86] irda: precedence bug in irlmp_seq_hb_idx() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 08/86] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 16/86] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 33/86] Bluetooth: ath3k: Add new AR3012 0930:021c id Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 02/86] x86/setup: Fix low identity map for >= 2GB kernel range Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 20/86] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 29/86] ext4, jbd2: ensure entering into panic after recording an error in superblock Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 25/86] iommu/vt-d: Fix error in detect ATS capability Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 05/86] drm/radeon: fix quirk for MSI R7 370 Armor 2X Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 22/86] spi: ti-qspi: Fix data corruption seen on r/w stress test Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 28/86] [PATCH] fix calculation of meta_bg descriptor backups Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 10/86] ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context. Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 23/86] lockd: create NSM handles per net namespace Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 07/86] macvtap: unbreak receiving of gro skb with frag list Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 15/86] HID: core: Avoid uninitialized buffer access Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 01/86] x86/setup: Extend low identity map to cover whole kernel range Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 03/86] drm/radeon: add quirk for MSI R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 09/86] stmmac: Correctly report PTP capabilities. Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 24/86] ARM: common: edma: Fix channel parameter for irq callbacks Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 21/86] ARM: 8427/1: dma-mapping: add support for offset parameter in dma_mmap() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 26/86] iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 27/86] ext4: fix potential use after free in __ext4_journal_stop Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 30/86] vTPM: fix memory allocation flag for rtce buffer at kernel boot Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100

csiph-web