Bluetooth: Fix l2cap conn failures for ssp devices

commit 18daf1644e634bae951a6e3d4d19d89170209762 upstream

Commit 330605423c fixed l2cap conn establishment for non-ssp remote
devices by not setting HCI_CONN_ENCRYPT_PEND every time conn security
is tested (which was always returning failure on any subsequent
security checks).

However, this broke l2cap conn establishment for ssp remote devices
when an ACL link was already established at SDP-level security. This
fix ensures that encryption must be pending whenever authentication
is also pending.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

Conflicts:

	net/bluetooth/hci_conn.c
Bluetooth: hci_core: fix NULL-pointer dereference at unregister

commit 94324962066231a938564bebad0f941cd2d06bb2 upstream.

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
   eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
   hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[   79.627136] INFO: trying to register non-static key.
[   79.632354] the code is fine but needs lockdep annotation.
[   79.638122] turning off the locking correctness validator.
[   79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
[   79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
[   79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
[   79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[   79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[   79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[   79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[   79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[   79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.723358] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   79.756011] pgd = cf3b4000
[   79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[   79.765502] Internal error: Oops: 80000007 [#1]
[   79.770294] Modules linked in:
[   79.773529] CPU: 0    Tainted: G        W     (3.3.0-rc6-00002-gb5d5c87 #421)
[   79.781066] PC is at 0x0
[   79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[   79.788787] pc : [<00000000>]    lr : [<c0040aa4>]    psr: 60000113
[   79.788787] sp : cf281ee0  ip : 00000000  fp : cf280000
[   79.800903] r10: 00000004  r9 : 00000100  r8 : b6f234d0
[   79.806427] r7 : c0519c28  r6 : cf093488  r5 : c0561a00  r4 : 00000000
[   79.813323] r3 : 00000000  r2 : c054eee0  r1 : 00000001  r0 : 00000000
[   79.820190] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   79.827728] Control: 10c5387d  Table: 8f3b4019  DAC: 00000015
[   79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[   79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[   79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[   79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[   79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[   79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[   79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[   79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[   79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[   79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[   79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[   79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[   79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[   79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[   79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[   79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.973083] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.997161] Code: bad PC value
[   80.000396] ---[ end trace 6f6739840475f9ee ]---
[   80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bluetooth: Enforce MEDIUM_SECURITY for 2.0 pairing.

The Security levels have been decided based on
remote_features or remote_extended_features for 2.0
and 2.1 devices. In case of security mode - 3 pairing,
this data is not available since pairing happens before
ACL connection complete. This patch fixes this problem.

CRs-fixed: 350377
Signed-off-by: Prabhakaran Mc <prabhakaranmc@codeaurora.org>
(cherry picked from commit 76a835518f89d07213ce52c1c911cd4df3b2305f)

Change-Id: Ia903c44003a41346eaa3d6fa389a72f96b0f6df1
Signed-off-by: Zhoulu Luo <zluo@codeaurora.org>

Conflicts:

	net/bluetooth/hci_event.c
	net/bluetooth/mgmt.c
Bluetooth : Ignore incomming events when the hci device is down

In error conditions Adapter state machine via Bluez tries to reset
the hci device, during that in some rare scenario if some pending event
comes from riva, the command complete apis tries to access some already
freed memory in reset sequence.

CRs-fixed: 369658
Signed-off-by: Bhasker Neti <bneti@codeaurora.org>
(cherry picked from commit 6f4ceb1f8588aec11b4d9380cd328d0008c8d167)

Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
(cherry picked from commit d686446400fd0a5645ff2d1e1b9f0249748ce5f8)

Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
(cherry picked from commit 69c592dd2a4b3ea95fe82970737bbbd2da8588b7)

Change-Id: Ic4cb65d405a4928b5a45aaad9c1d8ad1f6e67907
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
Bluetooth : hidp: Get the valid hci_conn while unlink

Since the context where unlink will be called is unaware of
validity of hci_conn pointer, fetch the valid hci_conn
before unlink.

CRs-fixed: 370274
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
(cherry picked from commit f411769619b631aa0d9f7d460bcfec4ff3e6f54a)

Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
(cherry picked from commit fce25f117ec7ea4296f550f8ed819dc517f89172)

Signed-off-by: Sunil Joseph <sunilj@codeaurora.org>
(cherry picked from commit 025e910a412c9f5d2e8d247e69afdb3041706a3a)

Change-Id: I60c9024c1c27d18ee2852166eed03a4c8593ca88
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
Bluetooth: hidp: use dest address from session info

While hid device unpair process, we are trying to access released
socket as apart of getting hci device which results a kernel panic.

CRs-fixed: 387164
Signed-off-by: Ram Mohan Korukonda <rkorukon@codeaurora.org>
(cherry picked from commit 27e77d2bda65c96815cb5f785df9ffd7bd733e6a)

Change-Id: Ic4359adf41c3da4effba25856169629787b5f7e0
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
Bluetooth: Disable sniff when the subrate values doesnt match.

Found there is possibility of sniff subrate collision with some
IOT devices. When this collision happned if the remote device
send subrate values that doesn't match with DUT supported
values exit sniff mode. This will allow DUT to reconfigure
sniff after idle time.

CRs-fixed: 380811
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit a7c3d7e6d905bab198003f16316971ae872eec9f)

Change-Id: Ibe3d02c6a404bbce677c7d980f0ad124e31bca26
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: fix shutdown on SCO sockets

shutdown should wait for SCO link to be properly disconnected before
detroying the socket, otherwise an application using the socket may
assume link is properly disconnected before it really happens which
can be a problem when e.g synchronizing profile switch.

CRs-fixed: 365445
Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit 2e02b861173406a1287a53ca7b836a4ad5fd4255)

Change-Id: Icc38e940f8008d908077dbdea16bc5c6420d1371
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Block SCO disconnect operation on BT_CLOSED state.

Have maximum blocking time for shutdown operation as DISCONNECT_TIMEOUT.
During this period when SCO connection closes, the userspace will be
updated on the close operation. Existing approach of immidiate return
on shutdown call can cause synchronization issues on SCO state between
kernel and userspace. This happens when disconnect operation takes
more time at kernel space.

CRs-fixed: 365445
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit f799996e309cad545b3a7f84ef6f333a09c8b876)

Change-Id: Ifa74d2568d2ee157a605a405017d4cc0f05d41fc
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
bluetooth: Add support for LE conn param

Added support to let the userspace know about the updated
LE connection parameters. On receiving successful connection
complete and connection parameters update event from the BT
Controller, send a mgmt event to the userspace bluetoothd.

CRs-fixed: 380271
Change-Id: If8c3d785188e0d4f38c7431d01c016f399137408
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit a42b50244cdb71f93bf842a28b0fc1cecc622c55)
Bluetooth: Prevents update of Low Energy connection parameters

The start encryption command fails when the LE update
connection parameters request is pending.
Hence, prevent the update of LE connection parameters during the
bonding process. The update of connection parameters is
not necessary during bonding process.

CRs-fixed: 380257
Change-Id: I41cb3998fecc2297d61ec97d66ac35a0bd41ca80
Signed-off-by: Subramanian Srinivasan <subrsrin@codeaurora.org>
Bluetooth: Send Disconnection reason to Bluez

Send device disconnection reason to bluez on receiving the
diconnection complete event so that low energy profiles
such as proximity can decide to reconnect if the reason
is link loss.

CRs-fixed: 378240
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
(cherry picked from commit da09d26a75ee1c7c1911dcfbe0128fd09f6631f4)

Change-Id: I5fb2041c34922dab95a483b3409553d3be5b5042
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Add sockopts for LE Connection Params

Various LE profiles require very specific LE parameters for
both establishing and maintaining LE connections to remote
peripherals. These LE only parameters are encapsulated into
a single sockopts structure, and may be passed from user space.

CRs-fixed: 335971 387146
Signed-off-by: Brian Gix <bgix@codeaurora.org>
(cherry picked from commit a94b6122f4f7a44dc1d6e6a5dfd2533cad7a3abf)

Change-Id: Iaa2e6a8b371a5463d335d5ea30fd96493a1688b6
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Fix for supervision timeout must be 6X connection interval

Added a new function to verify whether the LE Connection Update
parameters are valid instaed of verifying all the LE Connection
parameters since only update parameters are set in the Connection
Update Request.

CRs-Fixed: 387146
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
(cherry picked from commit 95319af0612d58788279748f586cc57221c3443e)

Change-Id: I3b803235150fc2b4508977d766b0f309a74de0c0
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
bluetooth: LE conn whitelist implementation

Add support to create connection to LE devices using
whitelist. With this, the Controller can try to connect
to multiple devices at the same time. The following
interfaces are added.
1. Add/Remove device from whitelist
2. Clear all the devices from whitelist
3. Create Connection to devices from whitelist
4. Cancel create connection to whitelist devices

CRs-fixed: 388980
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit 93bef895b01b79f49af60ba1394c9c3f6e563212)

Change-Id: Ib2f7879287d3b9fb453f52ebe6e63e961e91d4e4
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>

Conflicts:

	net/bluetooth/hci_event.c
xt_IDLETIMER:
Add new netlink msg type for IDLETIMER.

Send notifications when the label becomes active after an idle period.
Send netlink message notifications in addition to sysfs notifications.

Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
netfilter: xt_IDLETIMER: Use uevent instead of new netlink msg type

Send netlink message notifications using a uevent with
  subsystem=xt_idletimer
  INTERFACE=...
  STATE={active,inactive}
instead of needing a new netlink message type.
Revert the netlink.h change added by commit
  beb914e987cbbd368988d2b94a6661cb907c4d5a

Change-Id: I6881936bf754f3367ff3c8f6c1e9661cec0357d4
Signed-off-by: JP Abgrall <jpa@google.com>
netfilter: xt_qtaguid: start tracking iface rx/tx at low level

qtaguid tracks the device stats by monitoring when it goes up and down,
then it gets the dev_stats().
But devs don't correctly report stats (either they don't count headers
symmetrically between rx/tx, or they count internal control messages).

Now qtaguid counts the rx/tx bytes/packets during raw:prerouting and
mangle:postrouting (nat is not available in ipv6).

The results are in
  /proc/net/xt_qtaguid/iface_stat_fmt
which outputs a format line (bash expansion):
  ifname  total_skb_{rx,tx}_{bytes,packets}

Added event counters for pre/post handling.
Added extra ctrl_*() pid/uid debugging.

Change-Id: Id84345d544ad1dd5f63e3842cab229e71d339297
Signed-off-by: JP Abgrall <jpa@google.com>
lge: d1lsk: enable SELinux in default config
lge: d1l: enable SELinux in default config