Update compat-wireless to 2.6.36-5-spn

chromeos/compat-wireless/net/bluetooth/l2cap.c

 /*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
    Copyright (C) 2010 Google Inc.
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License version 2 as
@@ skipping 1431 matching lines @@
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
 
         BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
 
         hci_send_acl(pi->conn->hcon, skb, 0);
 }
 
 static void l2cap_streaming_send(struct sock *sk)
 {
-        struct sk_buff *skb, *tx_skb;
+        struct sk_buff *skb;
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         u16 control, fcs;
 
-        while ((skb = sk->sk_send_head)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
-
-                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
+                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
                 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
-                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
 
                 if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
-                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
                 }
 
-                l2cap_do_send(sk, tx_skb);
+                l2cap_do_send(sk, skb);
 
                 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
-                else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
-
-                skb = skb_dequeue(TX_QUEUE(sk));
-                kfree_skb(skb);
         }
 }
 
 static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *skb, *tx_skb;
         u16 control, fcs;
 
         skb = skb_peek(TX_QUEUE(sk));
@@ skipping 472 matching lines @@
         struct l2cap_options opts;
         int len, err = 0;
         u32 opt;
 
         BT_DBG("sk %p", sk);
 
         lock_sock(sk);
 
         switch (optname) {
         case L2CAP_OPTIONS:
+                if (sk->sk_state == BT_CONNECTED) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
                 opts.mode     = l2cap_pi(sk)->mode;
                 opts.fcs      = l2cap_pi(sk)->fcs;
                 opts.max_tx   = l2cap_pi(sk)->max_tx;
                 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 
                 len = min_t(unsigned int, sizeof(opts), optlen);
                 if (copy_from_user((char *) &opts, optval, len)) {
@@ skipping 795 matching lines @@
 
         BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
 
         while (len >= L2CAP_CONF_OPT_SIZE) {
                 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
 
                 switch (type) {
                 case L2CAP_CONF_MTU:
                         if (val < L2CAP_DEFAULT_MIN_MTU) {
                                 *result = L2CAP_CONF_UNACCEPT;
-                                pi->omtu = L2CAP_DEFAULT_MIN_MTU;
+                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
                         } else
-                                pi->omtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                                pi->imtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
                         pi->flush_to = val;
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
                                                         2, pi->flush_to);
                         break;
 
                 case L2CAP_CONF_RFC:
                         if (olen == sizeof(rfc))
@@ skipping 276 matching lines @@
 
         default:
                 l2cap_chan_del(sk, ECONNREFUSED);
                 break;
         }
 
         bh_unlock_sock(sk);
         return 0;
 }
 
+static inline void set_default_fcs(struct l2cap_pinfo *pi)
+{
+        /* FCS is enabled only in ERTM or streaming mode, if one or both
+         * sides request it.
+         */
+        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
+                pi->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                pi->fcs = L2CAP_FCS_CRC16;
+}
+
 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
         u16 dcid, flags;
         u8 rsp[64];
         struct sock *sk;
         int len;
 
         dcid  = __le16_to_cpu(req->dcid);
         flags = __le16_to_cpu(req->flags);
 
         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
 
         sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
         if (!sk)
                 return -ENOENT;
 
-        if (sk->sk_state != BT_CONFIG) {
-                struct l2cap_cmd_rej rej;
-
-                rej.reason = cpu_to_le16(0x0002);
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
-                                sizeof(rej), &rej);
+        if (sk->sk_state == BT_DISCONN)
                 goto unlock;
-        }
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                 l2cap_build_conf_rsp(sk, rsp,
                                         L2CAP_CONF_REJECT, flags), rsp);
                 goto unlock;
         }
 
@@ skipping 19 matching lines @@
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
         l2cap_pi(sk)->num_conf_rsp++;
 
         /* Reset config buffer. */
         l2cap_pi(sk)->conf_len = 0;
 
         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
 
                 l2cap_pi(sk)->next_tx_seq = 0;
                 l2cap_pi(sk)->expected_tx_seq = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
                 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
                         l2cap_ertm_init(sk);
 
                 l2cap_chan_ready(sk);
@@ skipping 67 matching lines @@
                 l2cap_send_disconn_req(conn, sk, ECONNRESET);
                 goto done;
         }
 
         if (flags & 0x01)
                 goto done;
 
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
                 l2cap_pi(sk)->next_tx_seq = 0;
                 l2cap_pi(sk)->expected_tx_seq = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
                 if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
                         l2cap_ertm_init(sk);
 
                 l2cap_chan_ready(sk);
         }
@@ skipping 1631 matching lines @@
 module_exit(l2cap_exit);
 
 module_param(disable_ertm, bool, 0644);
 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
 
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("bt-proto-0");