Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/blueto...

diff --combined net/bluetooth/hci_event.c
index 4221bd256bddfd89e147f1605f0dd334aa042ea6,d37f5b2a3e3c9d1fe8e7c2f217eef5ae06c25577..001307f810577111d0bbeea9265e0da37574cb5e
--- 1/net/bluetooth/hci_event.c
--- 2/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@@ -45,7 -45,7 +45,7 @@@
  #include <net/bluetooth/bluetooth.h>
  #include <net/bluetooth/hci_core.h>
  
 -static int enable_le;
 +static bool enable_le;
  
  /* Handle HCI Event packets */
  
@@@ -711,7 -711,14 +711,14 @@@ static void hci_cc_read_local_ext_featu
        if (rp->status)
                return;
  
-       memcpy(hdev->extfeatures, rp->features, 8);
+       switch (rp->page) {
+       case 0:
+               memcpy(hdev->features, rp->features, 8);
+               break;
+       case 1:
+               memcpy(hdev->host_features, rp->features, 8);
+               break;
+       }
  
        hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
  }
@@@ -1047,9 -1054,7 +1054,7 @@@ static void hci_cc_le_set_scan_enable(s
        case LE_SCANNING_DISABLED:
                clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
  
-               cancel_delayed_work_sync(&hdev->adv_work);
-               queue_delayed_work(hdev->workqueue, &hdev->adv_work,
-                                                jiffies + ADV_CLEAR_TIMEOUT);
+               schedule_delayed_work(&hdev->adv_work, ADV_CLEAR_TIMEOUT);
                break;
  
        default:
@@@ -2266,20 -2271,19 +2271,19 @@@ static inline void hci_num_comp_pkts_ev
        struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
        int i;
  
-       skb_pull(skb, sizeof(*ev));
- 
-       BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
- 
        if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
                BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
                return;
        }
  
-       if (skb->len < ev->num_hndl * 4) {
+       if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
+                       ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
                BT_DBG("%s bad parameters", hdev->name);
                return;
        }
  
+       BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
+ 
        for (i = 0; i < ev->num_hndl; i++) {
                struct hci_comp_pkts_info *info = &ev->handles[i];
                struct hci_conn *conn;

diff --combined net/bluetooth/hci_sock.c
index 6d94616af3129b3519c914c3458eb30cad40de05,896a72f723107d0ce99e15a6682379485a321e57..0dcc9626677973d23708b53c7716a126adea107f
--- 1/net/bluetooth/hci_sock.c
--- 2/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@@ -49,7 -49,7 +49,7 @@@
  #include <net/bluetooth/bluetooth.h>
  #include <net/bluetooth/hci_core.h>
  
 -static int enable_mgmt;
 +static bool enable_mgmt;
  
  /* ----- HCI socket interface ----- */
  
@@@ -767,7 -767,6 +767,6 @@@ static int hci_sock_dev_event(struct no
                /* Detach sockets from device */
                read_lock(&hci_sk_list.lock);
                sk_for_each(sk, node, &hci_sk_list.head) {
-                       local_bh_disable();
                        bh_lock_sock_nested(sk);
                        if (hci_pi(sk)->hdev == hdev) {
                                hci_pi(sk)->hdev = NULL;
@@@ -778,7 -777,6 +777,6 @@@
                                hci_dev_put(hdev);
                        }
                        bh_unlock_sock(sk);
-                       local_bh_enable();
                }
                read_unlock(&hci_sk_list.lock);
        }

diff --combined net/bluetooth/l2cap_core.c
index aa78d8c4b93be75f630e1389b4886ffdd4ab3623,3ee9bdeaa993c8a1744539d8ef8a659624a02303..faf0b11ac1d3610805e6d049f4a2e2221c35053a
--- 1/net/bluetooth/l2cap_core.c
--- 2/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -57,7 -57,7 +57,7 @@@
  #include <net/bluetooth/l2cap.h>
  #include <net/bluetooth/smp.h>
  
 -int disable_ertm;
 +bool disable_ertm;
  
  static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
  static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
@@@ -165,7 -165,7 +165,7 @@@ int l2cap_add_psm(struct l2cap_chan *ch
  {
        int err;
  
-       write_lock_bh(&chan_list_lock);
+       write_lock(&chan_list_lock);
  
        if (psm && __l2cap_global_chan_by_addr(psm, src)) {
                err = -EADDRINUSE;
@@@ -190,17 -190,17 +190,17 @@@
        }
  
  done:
-       write_unlock_bh(&chan_list_lock);
+       write_unlock(&chan_list_lock);
        return err;
  }
  
  int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
  {
-       write_lock_bh(&chan_list_lock);
+       write_lock(&chan_list_lock);
  
        chan->scid = scid;
  
-       write_unlock_bh(&chan_list_lock);
+       write_unlock(&chan_list_lock);
  
        return 0;
  }
@@@ -289,9 -289,9 +289,9 @@@ struct l2cap_chan *l2cap_chan_create(st
  
        chan->sk = sk;
  
-       write_lock_bh(&chan_list_lock);
+       write_lock(&chan_list_lock);
        list_add(&chan->global_l, &chan_list);
-       write_unlock_bh(&chan_list_lock);
+       write_unlock(&chan_list_lock);
  
        INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
  
@@@ -306,9 -306,9 +306,9 @@@
  
  void l2cap_chan_destroy(struct l2cap_chan *chan)
  {
-       write_lock_bh(&chan_list_lock);
+       write_lock(&chan_list_lock);
        list_del(&chan->global_l);
-       write_unlock_bh(&chan_list_lock);
+       write_unlock(&chan_list_lock);
  
        l2cap_chan_put(chan);
  }
@@@ -543,14 -543,14 +543,14 @@@ static u8 l2cap_get_ident(struct l2cap_
         *  200 - 254 are used by utilities like l2ping, etc.
         */
  
-       spin_lock_bh(&conn->lock);
+       spin_lock(&conn->lock);
  
        if (++conn->tx_ident > 128)
                conn->tx_ident = 1;
  
        id = conn->tx_ident;
  
-       spin_unlock_bh(&conn->lock);
+       spin_unlock(&conn->lock);
  
        return id;
  }
@@@ -1190,7 -1190,7 +1190,7 @@@ inline int l2cap_chan_connect(struct l2
        }
  
        /* Set destination address and psm */
-       bacpy(&bt_sk(sk)->dst, src);
+       bacpy(&bt_sk(sk)->dst, dst);
        chan->psm = psm;
        chan->dcid = cid;
  
@@@ -4702,7 -4702,7 +4702,7 @@@ static int l2cap_debugfs_show(struct se
  {
        struct l2cap_chan *c;
  
-       read_lock_bh(&chan_list_lock);
+       read_lock(&chan_list_lock);
  
        list_for_each_entry(c, &chan_list, global_l) {
                struct sock *sk = c->sk;
@@@ -4715,7 -4715,7 +4715,7 @@@
                                        c->sec_level, c->mode);
  }
  
-       read_unlock_bh(&chan_list_lock);
+       read_unlock(&chan_list_lock);
  
        return 0;
  }

diff --combined net/bluetooth/sco.c
index 5dc2f2126fac669a2f1b961efb8ce665768da2f2,471283e202545629b13b859eb16d487b9d3dafc4..8bf26d1bc5c181e25641622d980c0f812a6780e0
--- 1/net/bluetooth/sco.c
--- 2/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@@ -51,7 -51,7 +51,7 @@@
  #include <net/bluetooth/hci_core.h>
  #include <net/bluetooth/sco.h>
  
 -static int disable_esco;
 +static bool disable_esco;
  
  static const struct proto_ops sco_sock_ops;
  
@@@ -482,7 -482,7 +482,7 @@@ static int sco_sock_bind(struct socket 
                goto done;
        }
  
-       write_lock_bh(&sco_sk_list.lock);
+       write_lock(&sco_sk_list.lock);
  
        if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
                err = -EADDRINUSE;
@@@ -492,7 -492,7 +492,7 @@@
                sk->sk_state = BT_BOUND;
        }
  
-       write_unlock_bh(&sco_sk_list.lock);
+       write_unlock(&sco_sk_list.lock);
  
  done:
        release_sock(sk);
@@@ -965,14 -965,14 +965,14 @@@ static int sco_debugfs_show(struct seq_
        struct sock *sk;
        struct hlist_node *node;
  
-       read_lock_bh(&sco_sk_list.lock);
+       read_lock(&sco_sk_list.lock);
  
        sk_for_each(sk, node, &sco_sk_list.head) {
                seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
                                batostr(&bt_sk(sk)->dst), sk->sk_state);
        }
  
-       read_unlock_bh(&sco_sk_list.lock);
+       read_unlock(&sco_sk_list.lock);
  
        return 0;
  }