* RE: [v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident
2026-03-18 18:09 [PATCH v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident Luiz Augusto von Dentz
@ 2026-03-18 19:15 ` bluez.test.bot
2026-03-18 21:56 ` [PATCH v3] " Luiz Augusto von Dentz
2026-03-19 14:26 ` Christian Eggers
2 siblings, 0 replies; 4+ messages in thread
From: bluez.test.bot @ 2026-03-18 19:15 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 2908 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1068803
---Test result---
Test Summary:
CheckPatch PENDING 0.40 seconds
GitLint PENDING 0.33 seconds
SubjectPrefix PASS 0.11 seconds
BuildKernel PASS 26.51 seconds
CheckAllWarning PASS 29.30 seconds
CheckSparse PASS 27.94 seconds
BuildKernel32 PASS 32.66 seconds
TestRunnerSetup PASS 574.24 seconds
TestRunner_l2cap-tester PASS 27.95 seconds
TestRunner_iso-tester FAIL 45.96 seconds
TestRunner_bnep-tester PASS 6.32 seconds
TestRunner_mgmt-tester FAIL 114.54 seconds
TestRunner_rfcomm-tester PASS 9.37 seconds
TestRunner_sco-tester FAIL 16.25 seconds
TestRunner_ioctl-tester PASS 10.16 seconds
TestRunner_mesh-tester FAIL 11.47 seconds
TestRunner_smp-tester PASS 8.71 seconds
TestRunner_userchan-tester PASS 6.61 seconds
IncrementalBuild PENDING 0.96 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x7e/0x2b0
Total: 141, Passed: 141 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.102 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 1.876 seconds
Mesh - Send cancel - 2 Timed out 1.995 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident
2026-03-18 18:09 [PATCH v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident Luiz Augusto von Dentz
2026-03-18 19:15 ` [v3] " bluez.test.bot
@ 2026-03-18 21:56 ` Luiz Augusto von Dentz
2026-03-19 14:26 ` Christian Eggers
2 siblings, 0 replies; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2026-03-18 21:56 UTC (permalink / raw)
To: linux-bluetooth, Christian Eggers
Hi Christian,
On Wed, Mar 18, 2026 at 2:09 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This attempt to fix regressions caused by reusing ident which apparently
> is not handled well on certain stacks causing the stack to not respond to
> requests, so instead of simple returning the first unallocated id this
> stores the last used tx_ident and then attempt to use the next until all
> available ids are exausted and then cycle starting over to 1.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177
> Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> include/net/bluetooth/l2cap.h | 1 +
> net/bluetooth/l2cap_core.c | 23 ++++++++++++++++++++---
> 2 files changed, 21 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
> index 010f1a8fd15f..5172afee5494 100644
> --- a/include/net/bluetooth/l2cap.h
> +++ b/include/net/bluetooth/l2cap.h
> @@ -658,6 +658,7 @@ struct l2cap_conn {
> struct sk_buff *rx_skb;
> __u32 rx_len;
> struct ida tx_ida;
> + __u8 tx_ident;
>
> struct sk_buff_head pending_rx;
> struct work_struct pending_rx_work;
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index ead51dc0f3f1..a818a58362d5 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -926,16 +926,33 @@ int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
>
> static int l2cap_get_ident(struct l2cap_conn *conn)
> {
> + u8 max;
> + int ident;
> +
> /* LE link does not support tools like l2ping so use the full range */
> if (conn->hcon->type == LE_LINK)
> - return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
> -
> + max = 255;
> /* Get next available identificator.
> * 1 - 128 are used by kernel.
> * 129 - 199 are reserved.
> * 200 - 254 are used by utilities like l2ping, etc.
> */
> - return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
> + else
> + max = 128;
> +
> + /* Allocate ident using min as last used + 1 (cyclic) */
> + ident = ida_alloc_range(&conn->tx_ida, conn->tx_ident + 1, max,
> + GFP_ATOMIC);
> + /* Force min 1 to start over */
> + if (ident <= 0)
> + ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
> +
> + if (ident > 0)
> + conn->tx_ident = ident;
> + else
> + BT_ERR("Uanble to allocate ident: %d", ident);
> +
> + return conn->tx_ident;
> }
>
> static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
> --
> 2.53.0
Give this a try.
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident
2026-03-18 18:09 [PATCH v3] Bluetooth: L2CAP: Fix regressions caused by reusing ident Luiz Augusto von Dentz
2026-03-18 19:15 ` [v3] " bluez.test.bot
2026-03-18 21:56 ` [PATCH v3] " Luiz Augusto von Dentz
@ 2026-03-19 14:26 ` Christian Eggers
2 siblings, 0 replies; 4+ messages in thread
From: Christian Eggers @ 2026-03-19 14:26 UTC (permalink / raw)
To: linux-bluetooth, Luiz Augusto von Dentz
On Wednesday, 18 March 2026, 19:09:22 CET, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This attempt to fix regressions caused by reusing ident which apparently
> is not handled well on certain stacks causing the stack to not respond to
> requests, so instead of simple returning the first unallocated id this
> stores the last used tx_ident and then attempt to use the next until all
> available ids are exausted and then cycle starting over to 1.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177
> Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> include/net/bluetooth/l2cap.h | 1 +
> net/bluetooth/l2cap_core.c | 23 ++++++++++++++++++++---
> 2 files changed, 21 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
> index 010f1a8fd15f..5172afee5494 100644
> --- a/include/net/bluetooth/l2cap.h
> +++ b/include/net/bluetooth/l2cap.h
> @@ -658,6 +658,7 @@ struct l2cap_conn {
> struct sk_buff *rx_skb;
> __u32 rx_len;
> struct ida tx_ida;
> + __u8 tx_ident;
>
> struct sk_buff_head pending_rx;
> struct work_struct pending_rx_work;
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index ead51dc0f3f1..a818a58362d5 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -926,16 +926,33 @@ int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
>
> static int l2cap_get_ident(struct l2cap_conn *conn)
> {
> + u8 max;
> + int ident;
> +
> /* LE link does not support tools like l2ping so use the full range */
> if (conn->hcon->type == LE_LINK)
> - return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
> -
> + max = 255;
> /* Get next available identificator.
> * 1 - 128 are used by kernel.
> * 129 - 199 are reserved.
> * 200 - 254 are used by utilities like l2ping, etc.
> */
> - return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
> + else
> + max = 128;
> +
> + /* Allocate ident using min as last used + 1 (cyclic) */
> + ident = ida_alloc_range(&conn->tx_ida, conn->tx_ident + 1, max,
> + GFP_ATOMIC);
> + /* Force min 1 to start over */
> + if (ident <= 0)
> + ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
> +
> + if (ident > 0)
> + conn->tx_ident = ident;
> + else
> + BT_ERR("Uanble to allocate ident: %d", ident);
> +
> + return conn->tx_ident;
> }
>
> static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
>
PTS test L2CAP/COS/CED/BI-29-C is happy with this.
Tested-by: Christian Eggers <ceggers@arri.de>
^ permalink raw reply [flat|nested] 4+ messages in thread