Bluetooth: hidp: safely acquire hci connection
Claim device lock to safely enumerate hci connection list and bump
hci connection proxy device ref count simultaneously.
This patch incorporates David Herrmann's fix to prevent adding an
HID device when the hci connection no longer exists.
Change-Id: I9d57976ef935d7cc12ccded5c0a14ca06fc70475
Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Sumit Bajpai <sbajpai@codeaurora.org>
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index d80c0e3..74f1dcf 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -93,40 +93,15 @@
return NULL;
}
-static struct device *hidp_get_device(struct hidp_session *session)
-{
- bdaddr_t *dst = &session->bdaddr;
-
- struct device *device = NULL;
- struct hci_dev *hdev;
-
- hdev = hci_get_route(dst, BDADDR_ANY);
- if (!hdev)
- return NULL;
-
- session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
- if (session->conn)
- device = &session->conn->dev;
-
- hci_dev_put(hdev);
-
- return device;
-}
-
static void __hidp_link_session(struct hidp_session *session)
{
__module_get(THIS_MODULE);
list_add(&session->list, &hidp_session_list);
-
- hci_conn_hold_device(session->conn);
}
static void __hidp_unlink_session(struct hidp_session *session)
{
- struct device *dev;
-
- dev = hidp_get_device(session);
- if (dev)
+ if (session->conn)
hci_conn_put_device(session->conn);
list_del(&session->list);
@@ -660,6 +635,28 @@
return 0;
}
+static struct hci_conn *hidp_find_connection(struct hidp_session *session)
+{
+ bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
+ bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
+ struct hci_conn *conn;
+ struct hci_dev *hdev;
+
+ hdev = hci_get_route(dst, src);
+ if (!hdev)
+ return NULL;
+
+ hci_dev_lock_bh(hdev);
+ conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+ if (conn)
+ hci_conn_hold_device(conn);
+ hci_dev_unlock_bh(hdev);
+
+ hci_dev_put(hdev);
+
+ return conn;
+}
+
static int hidp_setup_input(struct hidp_session *session,
struct hidp_connadd_req *req)
{
@@ -707,7 +704,7 @@
input->relbit[0] |= BIT_MASK(REL_WHEEL);
}
- input->dev.parent = hidp_get_device(session);
+ input->dev.parent = &session->conn->dev;
input->event = hidp_input_event;
@@ -808,7 +805,7 @@
strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
- hid->dev.parent = hidp_get_device(session);
+ hid->dev.parent = &session->conn->dev;
hid->ll_driver = &hidp_hid_driver;
hid->hid_output_raw_report = hidp_output_raw_report;
@@ -855,6 +852,12 @@
goto failed;
}
+ session->conn = hidp_find_connection(session);
+ if (!session->conn) {
+ err = -ENOTCONN;
+ goto failed;
+ }
+
bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
@@ -874,6 +877,8 @@
session->flags = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
session->idle_to = req->idle_to;
+ __hidp_link_session(session);
+
if (req->rd_size > 0) {
err = hidp_setup_hid(session, req);
if (err && err != -ENODEV)
@@ -886,8 +891,6 @@
goto purge;
}
- __hidp_link_session(session);
-
hidp_set_timer(session);
err = kernel_thread(hidp_session, session, CLONE_KERNEL);
@@ -909,8 +912,6 @@
unlink:
hidp_del_timer(session);
- __hidp_unlink_session(session);
-
if (session->input) {
input_unregister_device(session->input);
session->input = NULL;
@@ -925,6 +926,8 @@
session->rd_data = NULL;
purge:
+ __hidp_unlink_session(session);
+
skb_queue_purge(&session->ctrl_transmit);
skb_queue_purge(&session->intr_transmit);