Bluetooth: Fix missing check for FIPS security level

When checking whether a legacy link key provides at least HIGH security
level we also need to check for FIPS level which is one step above HIGH.
This patch fixes a missing check in the hci_link_key_request_evt()
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Bluetooth: Fix L2CAP deadlock

-[0x01 Introduction

We have found a programming error causing a deadlock in Bluetooth subsystem
of Linux kernel. The problem is caused by missing release_sock() call when
L2CAP connection creation fails due full accept queue.

The issue can be reproduced with 3.15-rc5 kernel and is also present in
earlier kernels.

-[0x02 Details

The problem occurs when multiple L2CAP connections are created to a PSM which
contains listening socket (like SDP) and left pending, for example,
configuration (the underlying ACL link is not disconnected between
connections).

When L2CAP connection request is received and listening socket is found the
l2cap_sock_new_connection_cb() function (net/bluetooth/l2cap_sock.c) is called.
This function locks the 'parent' socket and then checks if the accept queue
is full.

1178         lock_sock(parent);
1179
1180         /* Check for backlog size */
1181         if (sk_acceptq_is_full(parent)) {
1182                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1183                 return NULL;
1184         }

If case the accept queue is full NULL is returned, but the 'parent' socket
is not released. Thus when next L2CAP connection request is received the code
blocks on lock_sock() since the parent is still locked.

Also note that for connections already established and waiting for
configuration to complete a timeout will occur and l2cap_chan_timeout()
(net/bluetooth/l2cap_core.c) will be called. All threads calling this
function will also be blocked waiting for the channel mutex since the thread
which is waiting on lock_sock() alread holds the channel mutex.

We were able to reproduce this by sending continuously L2CAP connection
request followed by disconnection request containing invalid CID. This left
the created connections pending configuration.

After the deadlock occurs it is impossible to kill bluetoothd, btmon will not
get any more data etc. requiring reboot to recover.

-[0x03 Fix

Releasing the 'parent' socket when l2cap_sock_new_connection_cb() returns NULL
seems to fix the issue.

Signed-off-by: Jukka Taimisto <jtt@codenomicon.com>
Reported-by: Tommi Mäkilä <tmakila@codenomicon.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Bluetooth: Remove unused LTK authentication defines

These defines were probably put in to track authenticated vs
unauthenticated LTKs, however since the LTK struct has a separate
boolean authenticated member these were never used.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Remove HCI_ prefix from SMP_ LTK defines

The LTK type has really nothing to do with HCI so it makes more sense to
have these in smp.h than hci.h. This patch moves the defines to smp.h
and removes the HCI_ prefix in the same go.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Fix missing hdev locking in smp_cmd_ident_addr_info

The hdev lock must be held before calling into smp_distribute_keys. Also
things such as hci_add_irk() require the lock. This patch fixes the
issue by adding the necessary locking into the smp_cmd_ident_addr_info
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Fix locking of hdev when calling into SMP code

The SMP code expects hdev to be unlocked (e.g. crypto functions will try
to (re)lock it) so ensure we release the call before calling into smp.c
from mgmt.c.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Update SMP crypto functions to take a hdev pointer

Passing the full hdev struct instead of just the crypto context allows
us to move the needed locking of hdev into the functions themselves as
well as do more helpful logging in the case of multi-adapter systems.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add ECC library for LE Secure Connections

This patch adds a simple ECC library that will act as a fundamental
building block for LE Secure Connections. The library has a simple API
consisting of two functions: one for generating a public/private key
pair and another one for generating a Diffie-Hellman key from a local
private key and a remote public key.

The code has been taken from https://github.com/kmackay/easy-ecc and
modified to conform with the kernel coding style.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add basic support for AES-CMAC

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add basic SMP defines for LE Secure Connections

This patch adds basic SMP defines for commands, error codes and PDU
definitions for the LE Secure Connections feature.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Extend SMP auth_req mask to include SC bits

In order to make use of the new bits in the authentication request
parameter we need to update the mask used for filtering out reserved
bits.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Update SMP security level to/from auth_req for SC

This patch updates the functions which map the SMP authentication
request to a security level and vice-versa to take into account the
Secure Connections feature.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add SMP flag for SC and set it when necessary.

This patch adds a new SMP flag for tracking whether Secure Connections
is in use and sets the flag when both remote and local side have elected
to use Secure Connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Add crypto functions
Bluetooth: Add mgmt support for LE Secure Connections LTK types

We need a dedicated LTK type for LTK resulting from a Secure Connections
based SMP pairing. This patch adds a new define for it and ensures that
both the New LTK event as well as the Load LTKs command supports it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Set the correct security level for SC LTKs

When the looked-up LTK is one generated by Secure Connections pairing
the security level it gives is BT_SECURITY_FIPS. This patch updates the
LTK request event handler to correctly set this level.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add SMP ah_ext() function

This patch adds the ah_ext() function for SMP used by LE Secure
Connections when starting encryption by a central that uses a Resolvable
Private Address.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Use custom macro for testing BR/EDR SC enabled

Since the HCI_SC_ENABLED flag will also be used for controllers without
BR/EDR Secure Connections support whenever we need to check specifically
for SC for BR/EDR we also need to check that the controller actually
supports it. This patch adds a convenience macro for check all the
necessary conditions and converts the places in the code that need it to
use it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Add mgmt_set_secure_conn support for any LE adapter

Since LE Secure Connections is a purely host-side feature we should
offer the Secure Connections mgmt setting for any adapter with LE
support. This patch updates the supported settings value and the
set_secure_conn command handler accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Make auth_req mask dependent on SC enabled or not

If we haven't enabled SC support on our side we should use the same mask
for the authentication requirement as we were using before SC support
was added.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>