[PATCH v2 0/2] Bluetooth: Fix Transport_Unit_Size and remove redundant NVMEM dependency

[PATCH v2 0/2] Bluetooth: Fix Transport_Unit_Size and remove redundant NVMEM dependency

[Zijun Hu]

This series contains a very simple bug fix and a trivial cleanup.

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
Changes in v2:
- Add patch 1 to fix Transport_Unit_Size for HCI data path
- Patch 2: Reword commit message
- Link to v1: https://patch.msgid.link/20261028-fix_kconf-v1-1-624788921368@oss.qualcomm.com

---
Zijun Hu (2):
      Bluetooth: hci_conn: Fix SCO/eSCO Transport_Unit_Size for HCI data path
      Bluetooth: hci_uart: Remove redundant NVMEM dependency

 drivers/bluetooth/Kconfig |  1 -
 net/bluetooth/hci_conn.c  | 18 ++++++++++++------
 2 files changed, 12 insertions(+), 7 deletions(-)
---
base-commit: 3f425f95ba3923d605f6a8b382e8fcdc59d479db
change-id: 20261028-fix_kconf-4d8e8748bb9f

Best regards,
--  
Zijun Hu <zijun.hu@oss.qualcomm.com>

[PATCH v2 1/2] Bluetooth: hci_conn: Fix SCO/eSCO Transport_Unit_Size for HCI data path

[Zijun Hu]

Correct (Input|Output)_Transport_Unit_Size based on Core spec v6.3,
Vol 4, Part E, 7.1.45:

  "The Host shall set the Input_Transport_Unit_Size and
   Output_Transport_Unit_Size to be equal. For HCI Host transport
   the Host shall set them to 0."

Fixes: b2af264ad3af ("Bluetooth: Add support for HCI_Enhanced_Setup_Synchronous_Connection command")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 net/bluetooth/hci_conn.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b007f623b2ec..eebd73988bf6 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -322,18 +322,20 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 		cp.in_coded_data_size = __cpu_to_le16(16);
 		cp.out_coded_data_size = __cpu_to_le16(16);
 		cp.in_pcm_data_format = 2;
 		cp.out_pcm_data_format = 2;
 		cp.in_pcm_sample_payload_msb_pos = 0;
 		cp.out_pcm_sample_payload_msb_pos = 0;
 		cp.in_data_path = conn->codec.data_path;
 		cp.out_data_path = conn->codec.data_path;
-		cp.in_transport_unit_size = 1;
-		cp.out_transport_unit_size = 1;
+		if (conn->codec.data_path) {
+			cp.in_transport_unit_size = 1;
+			cp.out_transport_unit_size = 1;
+		}
 		break;
 
 	case BT_CODEC_TRANSPARENT:
 		if (!find_next_esco_param(conn, esco_param_msbc,
 					  ARRAY_SIZE(esco_param_msbc)))
 			goto unlock;
 
 		param = &esco_param_msbc[conn->attempt - 1];
@@ -348,18 +350,20 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 		cp.in_coded_data_size = __cpu_to_le16(16);
 		cp.out_coded_data_size = __cpu_to_le16(16);
 		cp.in_pcm_data_format = 2;
 		cp.out_pcm_data_format = 2;
 		cp.in_pcm_sample_payload_msb_pos = 0;
 		cp.out_pcm_sample_payload_msb_pos = 0;
 		cp.in_data_path = conn->codec.data_path;
 		cp.out_data_path = conn->codec.data_path;
-		cp.in_transport_unit_size = 1;
-		cp.out_transport_unit_size = 1;
+		if (conn->codec.data_path) {
+			cp.in_transport_unit_size = 1;
+			cp.out_transport_unit_size = 1;
+		}
 		break;
 
 	case BT_CODEC_CVSD:
 		if (conn->parent && lmp_esco_capable(conn->parent)) {
 			if (!find_next_esco_param(conn, esco_param_cvsd,
 						  ARRAY_SIZE(esco_param_cvsd)))
 				goto unlock;
 			param = &esco_param_cvsd[conn->attempt - 1];
@@ -379,18 +383,20 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 		cp.in_coded_data_size = __cpu_to_le16(16);
 		cp.out_coded_data_size = __cpu_to_le16(16);
 		cp.in_pcm_data_format = 2;
 		cp.out_pcm_data_format = 2;
 		cp.in_pcm_sample_payload_msb_pos = 0;
 		cp.out_pcm_sample_payload_msb_pos = 0;
 		cp.in_data_path = conn->codec.data_path;
 		cp.out_data_path = conn->codec.data_path;
-		cp.in_transport_unit_size = 16;
-		cp.out_transport_unit_size = 16;
+		if (conn->codec.data_path) {
+			cp.in_transport_unit_size = 16;
+			cp.out_transport_unit_size = 16;
+		}
 		break;
 	default:
 		goto unlock;
 	}
 
 	hci_dev_unlock(hdev);
 
 	cp.retrans_effort = param->retrans_effort;

-- 
2.34.1

RE: Bluetooth: Fix Transport_Unit_Size and remove redundant NVMEM dependency

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3251 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1199849/

---Test result---

Test Summary:
CheckPatch                    PASS      1.13 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.45 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      31.36 seconds
CheckAllWarning               PASS      35.31 seconds
CheckSparse                   PASS      38.11 seconds
BuildKernel32                 PASS      30.63 seconds
CheckKernelLLVM               PASS      32.63 seconds
TestRunnerSetup               PASS      748.43 seconds
TestRunner_l2cap-tester       FAIL      12.36 seconds
TestRunner_iso-tester         PASS      11.09 seconds
TestRunner_bnep-tester        PASS      3.16 seconds
TestRunner_mgmt-tester        PASS      88.53 seconds
TestRunner_rfcomm-tester      PASS      4.50 seconds
TestRunner_sco-tester         PASS      5.67 seconds
TestRunner_ioctl-tester       PASS      4.72 seconds
TestRunner_mesh-tester        PASS      5.51 seconds
TestRunner_smp-tester         PASS      4.36 seconds
TestRunner_userchan-tester    PASS      3.22 seconds
TestRunner_6lowpan-tester     PASS      5.04 seconds
IncrementalBuild              PASS      33.82 seconds

Details
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==35==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bd3bd5e33d0 at pc 0x55ee46e8de8e bp 0x7ffff8207fa0 sp 0x7ffff8207f90
READ of size 4 at 0x7bd3bd5e33d0 thread T0
    #0 0x55ee46e8de8d in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x55ee46e8eb75 in timeout_callback src/shared/mainloop.c:270
    #2 0x55ee46e8faa6 in mainloop_run src/shared/mainloop.c:124
    #3 0x55ee46e923fa in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x55ee46e9764b in tester_run src/shared/tester.c:1223
    #5 0x55ee46dc117d in main tools/l2cap-tester.c:3918
    #6 0x7f93be567600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f93be567717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x55ee46dc7c84 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16cc84) (BuildId: 91c9d49e9766c394468e27ffa29b05e7d348169f)

0x7bd3bd5e33d0 is located 0 bytes inside of 40-byte region [0x7bd3bd5e33d0,0x7bd3bd5e33f8)
freed by thread T0 here:
    #0 0x7f93beea53ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x55ee46e8e36a in timeout_destroy src/shared/mainloop.c:251

previously allocated by thread T0 here:
    #0 0x7f93beea660f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x55ee46e782d5 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1050

---
Regards,
Linux Bluetooth

[PATCH v2 2/2] Bluetooth: hci_uart: Remove redundant NVMEM dependency

[Zijun Hu]

'depends on NVMEM || !NVMEM' always evaluates to y, so it has no
impact since the following commit changed NVMEM type from tristate
to bool:

Commit 2a37ce25d9f2 ("nvmem: disallow modular CONFIG_NVMEM")

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index b18482b5677f..ad5eabb8eb77 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -112,17 +112,16 @@ config BT_HCIBTSDIO
 	  SDIO interface.
 
 	  Say Y here to compile support for Bluetooth SDIO devices into the
 	  kernel or say M to compile it as module (btsdio).
 
 config BT_HCIUART
 	tristate "HCI UART driver"
 	depends on SERIAL_DEV_BUS || !SERIAL_DEV_BUS
-	depends on NVMEM || !NVMEM
 	depends on POWER_SEQUENCING || !POWER_SEQUENCING
 	depends on TTY
 	help
 	  Bluetooth HCI UART driver.
 	  This driver is required if you want to use Bluetooth devices with
 	  serial port interface. You will also need this driver if you have
 	  UART based Bluetooth PCMCIA and CF devices like Xircom Credit Card
 	  adapter and BrainBoxes Bluetooth PC Card.

-- 
2.34.1