Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetoot...

diff --combined net/bluetooth/hci_core.c
index 7140f83328a2a3b7ff00a5aa4fcdf72b87fcd5d9,ec7d3a7adf74ce0d1b1982a79596acfd75779e50..596660d37c5e56d6a0178b16b288a2d3c868f965
--- 1/net/bluetooth/hci_core.c
--- 2/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@@ -861,6 -861,9 +861,9 @@@ static int hci_dev_do_close(struct hci_
        /* Clear flags */
        hdev->flags = 0;
  
+       /* Controller radio is available but is currently powered down */
+       hdev->amp_status = 0;
+ 
        memset(hdev->eir, 0, sizeof(hdev->eir));
        memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
  
@@@ -1815,11 -1818,11 +1818,11 @@@ int hci_register_dev(struct hci_dev *hd
        if (hdev->dev_type != HCI_AMP)
                set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
  
 -      schedule_work(&hdev->power_on);
 -
        hci_notify(hdev, HCI_DEV_REG);
        hci_dev_hold(hdev);
  
 +      schedule_work(&hdev->power_on);
 +
        return id;
  
  err_wqueue:
@@@ -1854,6 -1857,8 +1857,8 @@@ void hci_unregister_dev(struct hci_dev 
        for (i = 0; i < NUM_REASSEMBLY; i++)
                kfree_skb(hdev->reassembly[i]);
  
+       cancel_work_sync(&hdev->power_on);
+ 
        if (!test_bit(HCI_INIT, &hdev->flags) &&
            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                hci_dev_lock(hdev);

diff --combined net/bluetooth/mgmt.c
index 142764aec2af6d4d7e6d5654e46e473c37c0218c,5d0ef759ef49ba8a6ab284cb7e80c50f90555dd0..f559b966279c13e8d1e0eb36afbcc465067c4e8d
--- 1/net/bluetooth/mgmt.c
--- 2/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@@ -326,7 -326,7 +326,7 @@@ static int read_index_list(struct sock 
        struct hci_dev *d;
        size_t rp_len;
        u16 count;
 -      int i, err;
 +      int err;
  
        BT_DBG("sock %p", sk);
  
@@@ -347,7 -347,9 +347,7 @@@
                return -ENOMEM;
        }
  
 -      rp->num_controllers = cpu_to_le16(count);
 -
 -      i = 0;
 +      count = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
                if (test_bit(HCI_SETUP, &d->dev_flags))
                        continue;
@@@ -355,13 -357,10 +355,13 @@@
                if (!mgmt_valid_hdev(d))
                        continue;
  
 -              rp->index[i++] = cpu_to_le16(d->id);
 +              rp->index[count++] = cpu_to_le16(d->id);
                BT_DBG("Added hci%u", d->id);
        }
  
 +      rp->num_controllers = cpu_to_le16(count);
 +      rp_len = sizeof(*rp) + (2 * count);
 +
        read_unlock(&hci_dev_list_lock);
  
        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
@@@ -1226,7 -1225,7 +1226,7 @@@ static int set_le(struct sock *sk, stru
        }
  
        val = !!cp->val;
-       enabled = !!lmp_host_le_capable(hdev);
+       enabled = lmp_host_le_capable(hdev);
  
        if (!hdev_is_powered(hdev) || val == enabled) {
                bool changed = false;
@@@ -1262,7 -1261,7 +1262,7 @@@
  
        if (val) {
                hci_cp.le = val;
-               hci_cp.simul = !!lmp_le_br_capable(hdev);
+               hci_cp.simul = lmp_le_br_capable(hdev);
        }
  
        err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
@@@ -1379,7 -1378,6 +1379,7 @@@ static int remove_uuid(struct sock *sk
                        continue;
  
                list_del(&match->list);
 +              kfree(match);
                found++;
        }
  
@@@ -2926,13 -2924,13 +2926,13 @@@ int mgmt_powered(struct hci_dev *hdev, 
                        struct hci_cp_write_le_host_supported cp;
  
                        cp.le = 1;
-                       cp.simul = !!lmp_le_br_capable(hdev);
+                       cp.simul = lmp_le_br_capable(hdev);
  
                        /* Check first if we already have the right
                         * host state (host features set)
                         */
-                       if (cp.le != !!lmp_host_le_capable(hdev) ||
-                           cp.simul != !!lmp_host_le_br_capable(hdev))
+                       if (cp.le != lmp_host_le_capable(hdev) ||
+                           cp.simul != lmp_host_le_br_capable(hdev))
                                hci_send_cmd(hdev,
                                             HCI_OP_WRITE_LE_HOST_SUPPORTED,
                                             sizeof(cp), &cp);