[Bluetooth] Missing endian swapping for L2CAP socket list

[pandora-kernel.git] / net / bluetooth / l2cap.c

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index eaaad65..be5a6e6 100644 (file)
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -185,7 +185,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 {
        struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 
-       write_lock(&l->lock);
+       write_lock_bh(&l->lock);
        if (sk == l->head)
                l->head = next;
 
@@ -193,7 +193,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
                l2cap_pi(next)->prev_c = prev;
        if (prev)
                l2cap_pi(prev)->next_c = next;
-       write_unlock(&l->lock);
+       write_unlock_bh(&l->lock);
 
        __sock_put(sk);
 }
@@ -313,9 +313,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 {
        struct l2cap_chan_list *l = &conn->chan_list;
-       write_lock(&l->lock);
+       write_lock_bh(&l->lock);
        __l2cap_chan_add(conn, sk, parent);
-       write_unlock(&l->lock);
+       write_unlock_bh(&l->lock);
 }
 
 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
@@ -328,14 +328,14 @@ static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
         *  200 - 254 are used by utilities like l2ping, etc.
         */
 
-       spin_lock(&conn->lock);
+       spin_lock_bh(&conn->lock);
 
        if (++conn->tx_ident > 128)
                conn->tx_ident = 1;
 
        id = conn->tx_ident;
 
-       spin_unlock(&conn->lock);
+       spin_unlock_bh(&conn->lock);
 
        return id;
 }
@@ -559,7 +559,7 @@ static int l2cap_sock_create(struct socket *sock, int protocol)
 
        sock->ops = &l2cap_sock_ops;
 
-       sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL);
+       sk = l2cap_sock_alloc(sock, protocol, GFP_ATOMIC);
        if (!sk)
                return -ENOMEM;
 
@@ -770,7 +770,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
        long timeo;
        int err = 0;
 
-       lock_sock(sk);
+       lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
        if (sk->sk_state != BT_LISTEN) {
                err = -EBADFD;
@@ -792,7 +792,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
 
                release_sock(sk);
                timeo = schedule_timeout(timeo);
-               lock_sock(sk);
+               lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
                if (sk->sk_state != BT_LISTEN) {
                        err = -EBADFD;
@@ -1353,12 +1353,12 @@ static inline int l2cap_conf_output(struct sock *sk, void **ptr)
 
        /* Configure output options and let the other side know
         * which ones we don't like. */
-       if (pi->conf_mtu < pi->omtu) {
-               l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+       if (pi->conf_mtu < pi->omtu)
                result = L2CAP_CONF_UNACCEPT;
-       } else {
+       else
                pi->omtu = pi->conf_mtu;
-       }
+
+       l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
        BT_DBG("sk %p result %d", sk, result);
        return result;
@@ -1416,11 +1416,11 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
        if (!sk)
                goto response;
 
-       write_lock(&list->lock);
+       write_lock_bh(&list->lock);
 
        /* Check if we already have channel with that dcid */
        if (__l2cap_get_chan_by_dcid(list, scid)) {
-               write_unlock(&list->lock);
+               write_unlock_bh(&list->lock);
                sock_set_flag(sk, SOCK_ZAPPED);
                l2cap_sock_kill(sk);
                goto response;
@@ -1458,7 +1458,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
        result = status = 0;
 
 done:
-       write_unlock(&list->lock);
+       write_unlock_bh(&list->lock);
 
 response:
        bh_unlock_sock(parent);
@@ -1533,6 +1533,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
                return -ENOENT;
 
+       if (sk->sk_state == BT_DISCONN)
+               goto unlock;
+
        l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
 
        if (flags & 0x0001) {
@@ -2147,8 +2150,8 @@ static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
 
                str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                               sk->sk_state, pi->psm, pi->scid, pi->dcid, pi->imtu,
-                               pi->omtu, pi->link_mode);
+                               sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
+                               pi->imtu, pi->omtu, pi->link_mode);
        }
 
        read_unlock_bh(&l2cap_sk_list.lock);
@@ -2216,7 +2219,8 @@ static int __init l2cap_init(void)
                goto error;
        }
 
-       class_create_file(bt_class, &class_attr_l2cap);
+       if (class_create_file(bt_class, &class_attr_l2cap) < 0)
+               BT_ERR("Failed to create L2CAP info file");
 
        BT_INFO("L2CAP ver %s", VERSION);
        BT_INFO("L2CAP socket layer initialized");