* [PATCH v5] Bluetooth: hci_qca: Convert timeout from jiffies to ms
From: Shuai Zhang @ 2026-04-29 12:38 UTC (permalink / raw)
To: Bartosz Golaszewski, Marcel Holtmann, Luiz Augusto von Dentz
Cc: linux-arm-msm, linux-bluetooth, linux-kernel, cheng.jiang,
quic_chezhou, wei.deng, jinwang.li, mengshi.wu, shuai.zhang,
stable, Paul Menzel, Bartosz Golaszewski
Since the timer uses jiffies as its unit rather than ms, the timeout value
must be converted from ms to jiffies when configuring the timer. Otherwise,
the intended 8s timeout is incorrectly set to approximately 33s.
Wake timer depends on commit c347ca17d62a
Cc: stable@vger.kernel.org
Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
Changes v5:
- add depends on commit
- Link to v4
https://lore.kernel.org/all/20260327082941.1396521-1-shuai.zhang@oss.qualcomm.com/
Changes v4:
- add review-by signoff
- Link to v3
https://lore.kernel.org/all/20251107033924.3707495-1-quic_shuaz@quicinc.com/
Changes v3:
- add Fixes tag
- Link to v2
https://lore.kernel.org/all/20251106140103.1406081-1-quic_shuaz@quicinc.com/
Changes v2:
- Split timeout conversion into a separate patch.
- Clarified commit messages and added test case description.
- Link to v1
https://lore.kernel.org/all/20251104112601.2670019-1-quic_shuaz@quicinc.com/
---
drivers/bluetooth/hci_qca.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index cd1834246..89073adec 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1607,7 +1607,7 @@ static void qca_wait_for_dump_collection(struct hci_dev *hdev)
struct qca_data *qca = hu->priv;
wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
- TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
+ TASK_UNINTERRUPTIBLE, msecs_to_jiffies(MEMDUMP_TIMEOUT_MS));
clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
}
--
2.34.1
^ permalink raw reply related
* [PATCH v2] Bluetooth: btusb: Allow firmware re-download when version matches
From: Shuai Zhang @ 2026-04-29 12:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: linux-bluetooth, linux-kernel, linux-arm-msm, cheng.jiang,
quic_chezhou, wei.deng, jinwang.li, mengshi.wu, shuai.zhang
The Bluetooth host decides whether to download firmware by reading the
controller firmware download completion flag and firmware version
information.
If a USB error occurs during the firmware download process (for example
due to a USB disconnect), the download is aborted immediately. An
incomplete firmware transfer does not cause the controller to set the
download completion flag, but the firmware version information may be
updated at an early stage of the download process.
In this case, after USB reconnection, the host attempts to re-download
the firmware because the download completion flag is not set. However,
since the controller reports the same firmware version as the target
firmware, the download is skipped. This ultimately results in the
firmware not being properly updated on the controller.
This change removes the restriction that skips firmware download when
the versions are equal. It covers scenarios where the USB connection
can be disconnected at any time and ensures that firmware download can
be retriggered after USB reconnection, allowing the Bluetooth firmware
to be correctly and completely updated.
Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
Changes v2:
- Update code comments and commit message to reflect the correct logic.
- Align the commit title with upstream conventions.
- Link v1
https://lore.kernel.org/all/20260108074353.1027877-1-shuai.zhang@oss.qualcomm.com/
---
drivers/bluetooth/btusb.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 572091e60..70abbabea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3550,7 +3550,13 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
"firmware rome 0x%x build 0x%x",
rver_rom, rver_patch, ver_rom, ver_patch);
- if (rver_rom != ver_rom || rver_patch <= ver_patch) {
+ /* Allow rampatch when the patch version equals the firmware version.
+ * A firmware download may be aborted by a transient USB error (e.g.
+ * disconnect) after the controller updates version info but before
+ * completion.
+ * Allowing equal versions enables re-flashing during recovery.
+ */
+ if (rver_rom != ver_rom || rver_patch < ver_patch) {
bt_dev_err(hdev, "rampatch file version did not match with firmware");
err = -EINVAL;
goto done;
--
2.34.1
^ permalink raw reply related
* [bluez/bluez] 07c44f: gatt-client: Fix use-after-free caused by reentran...
From: github-actions[bot] @ 2026-04-29 11:57 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087435
Home: https://github.com/bluez/bluez
Commit: 07c44f7b5232fc39c0dbad1e351210daac0c77db
https://github.com/bluez/bluez/commit/07c44f7b5232fc39c0dbad1e351210daac0c77db
Author: Jinwang Li <jinwang.li@oss.qualcomm.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M src/gatt-client.c
Log Message:
-----------
gatt-client: Fix use-after-free caused by reentrant client teardown
btd_gatt_client_service_removed() can be called reentrantly via
bt_gatt_client_unref() after the services queue has already been freed,
resulting in a use-after-free.
Reset client->ready to false before destroying the services queue to
prevent reentrant calls from dereferencing freed memory.
This was found with the following backtrace:
#0 match_service_handle ()
#1 queue_remove_if ()
#2 queue_remove_all ()
#3 btd_gatt_client_service_removed ()
#4 gatt_service_removed ()
#5 handle_notify ()
#6 queue_foreach ()
#7 notify_service_changed ()
#8 gatt_db_service_destroy ()
#9 queue_remove_all ()
#10 gatt_db_clear_range ()
#11 service_changed_failure ()
#12 discovery_op_unref ()
#13 bt_gatt_request_unref ()
#14 bt_gatt_client_cancel_all ()
#15 bt_gatt_client_free ()
#16 bt_gatt_client_unref ()
#17 bt_gatt_client_free ()
#18 bt_gatt_client_unref ()
#19 btd_gatt_client_destroy ()
#20 device_free ()
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH v1] gatt-client: Fix use-after-free caused by reentrant client teardown
From: Jinwang Li @ 2026-04-29 11:48 UTC (permalink / raw)
To: linux-bluetooth
Cc: cheng.jiang, quic_chezhou, wei.deng, shuai.zhang, mengshi.wu,
jinwang.li
btd_gatt_client_service_removed() can be called reentrantly via
bt_gatt_client_unref() after the services queue has already been freed,
resulting in a use-after-free.
Reset client->ready to false before destroying the services queue to
prevent reentrant calls from dereferencing freed memory.
This was found with the following backtrace:
#0 match_service_handle ()
#1 queue_remove_if ()
#2 queue_remove_all ()
#3 btd_gatt_client_service_removed ()
#4 gatt_service_removed ()
#5 handle_notify ()
#6 queue_foreach ()
#7 notify_service_changed ()
#8 gatt_db_service_destroy ()
#9 queue_remove_all ()
#10 gatt_db_clear_range ()
#11 service_changed_failure ()
#12 discovery_op_unref ()
#13 bt_gatt_request_unref ()
#14 bt_gatt_client_cancel_all ()
#15 bt_gatt_client_free ()
#16 bt_gatt_client_unref ()
#17 bt_gatt_client_free ()
#18 bt_gatt_client_unref ()
#19 btd_gatt_client_destroy ()
#20 device_free ()
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
---
src/gatt-client.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/gatt-client.c b/src/gatt-client.c
index 374e67c34..3baf95c4f 100644
--- a/src/gatt-client.c
+++ b/src/gatt-client.c
@@ -2261,6 +2261,8 @@ void btd_gatt_client_destroy(struct btd_gatt_client *client)
if (!client)
return;
+ client->ready = false;
+
queue_destroy(client->services, unregister_service);
queue_destroy(client->all_notify_clients, NULL);
queue_destroy(client->ios, NULL);
--
2.34.1
^ permalink raw reply related
* [PATCH v2] arm64: dts: monaco-arduino-monza: Add Bluetooth UART node
From: Shuai Zhang @ 2026-04-29 10:35 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley
Cc: linux-arm-msm, devicetree, linux-kernel, linux-bluetooth,
cheng.jiang, quic_chezhou, wei.deng, jinwang.li, mengshi.wu,
shuai.zhang
The QCA2066 Bluetooth chip is powered by a board-level 3.3 V supply
provided by the hardware. This change connects the Bluetooth
controller via UART10, and the corresponding GPIO is used to enable
the Bluetooth chip.
basic function test step:
- bluetoothctl power on/off
- bluetoothctl scan bredr/le
- bluetoothctl pair <remote device address>
- bluetoothctl connect <remote device address>
low-state test and state:
- rtcwake -d /dev/rtc0 -m no -s 30 && systemctl suspend
cat /sys/kernel/debug/suspend_stats
success: 1
fail: 0
failed_freeze: 0
failed_prepare: 0
failed_suspend: 0
failed_suspend_late: 0
failed_suspend_noirq: 0
failed_resume: 0
failed_resume_early: 0
failed_resume_noirq: 0
failures:
last_failed_dev:
last_failed_errno: 0
0
last_failed_step:
Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
Changes v2:
- Fix board name typo from "monac" to "monaco".
- Clarify that Bluetooth is connected via UART10.
- Add detailed testing steps, including suspend/resume and low-power validation.
- Document that the QCA2066 Bluetooth chip is powered by a board-level, hardware-provided 3.3 V supply, and that the GPIO is used only to enable the Bluetooth chip.
- Add the required sleep clock to satisfy the qcom,qca2066-bt DT binding and run dtbs_check.
- Fix DTS formatting issues and drop redundant status properties.
- Update authorship
- Link to v6
https://lore.kernel.org/all/20260428025652.662502-1-shuai.zhang@oss.qualcomm.com/
---
arch/arm64/boot/dts/qcom/monaco-arduino-monza.dts | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/monaco-arduino-monza.dts b/arch/arm64/boot/dts/qcom/monaco-arduino-monza.dts
index ca14f0ea4..379b796f2 100644
--- a/arch/arm64/boot/dts/qcom/monaco-arduino-monza.dts
+++ b/arch/arm64/boot/dts/qcom/monaco-arduino-monza.dts
@@ -21,6 +21,7 @@ aliases {
ethernet0 = ðernet0;
i2c1 = &i2c1;
serial0 = &uart7;
+ serial1 = &uart10;
};
chosen {
@@ -454,6 +455,16 @@ &uart7 {
status = "okay";
};
+&uart10 {
+ status = "okay";
+
+ bluetooth: bluetooth {
+ compatible = "qcom,qca2066-bt";
+ enable-gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
+ clocks = <&sleep_clk>;
+ };
+};
+
&usb_1 {
status = "okay";
};
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 9/9] arm64: dts: qcom: arduino-imola: Get Bluetooth BD address from NVMEM
From: Konrad Dybcio @ 2026-04-29 9:32 UTC (permalink / raw)
To: Loic Poulain, Ulf Hansson, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Jens Axboe,
Johannes Berg, Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
Cc: linux-mmc, devicetree, linux-kernel, linux-arm-msm, linux-block,
linux-wireless, ath10k, linux-bluetooth, netdev, daniel
In-Reply-To: <20260428-block-as-nvmem-v1-9-6ad23e75190a@oss.qualcomm.com>
On 4/28/26 4:23 PM, Loic Poulain wrote:
> On Arduino Uno-Q, the Bluetooth Device address is stored in the eMMC
> boot1 partition. Point to the appropriate NVMEM cell to retrieve it.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Konrad
^ permalink raw reply
* RE: [v3] Bluetooth: Add Synaptics 4384 Chip Support
From: Kaihsin Chung @ 2026-04-29 9:32 UTC (permalink / raw)
To: Luiz Augusto von Dentz, linux-bluetooth@vger.kernel.org
Cc: kaihsin.chung@synaptics.corp-partner.google.com
In-Reply-To: <CABBYNZJ3VLTcjLx+AOcS=x3r0pvrrEW0kAZEfT5caND7EJ-_=Q@mail.gmail.com>
HI Luiz,
I didn't see the apply patch failure on my side.
From your log, do you mean we should also add document in Documentation/devicetree/bindings
B.R
KaiHsin
-----Original Message-----
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Sent: Friday, April 10, 2026 10:17 PM
To: linux-bluetooth@vger.kernel.org
Cc: kaihsin.chung@synaptics.corp-partner.google.com
Subject: Re: [v3] Bluetooth: Add Synaptics 4384 Chip Support
CAUTION: Email originated externally, do not click links or open attachments unless you recognize the sender and know the content is safe.
Hi,
On Thu, Apr 9, 2026 at 4:20 PM <bluez.test.bot@gmail.com> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://urldefense.proofpoint.com/v2/url?u=https-3A__patchwork.kernel.org_project_bluetooth_list_-3Fseries-3D1078977&d=DwIFaQ&c=7dfBJ8cXbWjhc0BhImu8wVIoUFmBzj1s88r8EGyM0UY&r=_rvKD1lVMETnjfJne-APcrTZP0H9q0aBYQGmJWPSXJQ&m=OONH5zv5vMU43bEEZ3QknB0gB_vrzW9LOONd11Vx0z2qGVcvR94hfOX8xdyUbdlL&s=KTuNrxunr5r0yeCKm5BgwRrxJ3qTqJA4IPRifZ6X21U&e=
>
> ---Test result---
>
> Test Summary:
> CheckPatch PENDING 0.51 seconds
> GitLint PENDING 0.47 seconds
> SubjectPrefix PASS 0.06 seconds
> BuildKernel PASS 26.48 seconds
> CheckAllWarning PASS 28.63 seconds
> CheckSparse PASS 27.53 seconds
> BuildKernel32 PASS 25.59 seconds
> TestRunnerSetup PASS 567.27 seconds
> TestRunner_l2cap-tester PASS 27.85 seconds
> TestRunner_iso-tester PASS 38.54 seconds
> TestRunner_bnep-tester PASS 6.42 seconds
> TestRunner_mgmt-tester FAIL 113.62 seconds
> TestRunner_rfcomm-tester PASS 9.34 seconds
> TestRunner_sco-tester FAIL 14.29 seconds
> TestRunner_ioctl-tester PASS 10.37 seconds
> TestRunner_mesh-tester FAIL 11.55 seconds
> TestRunner_smp-tester PASS 8.52 seconds
> TestRunner_userchan-tester PASS 6.59 seconds
> TestRunner_6lowpan-tester FAIL 8.58 seconds
> IncrementalBuild PENDING 0.34 seconds
>
> Details
> ##############################
> Test: CheckPatch - PENDING
> Desc: Run checkpatch.pl script
> Output:
>
> ##############################
> Test: GitLint - PENDING
> Desc: Run gitlint
> Output:
>
> ##############################
> Test: TestRunner_mgmt-tester - FAIL
> Desc: Run mgmt-tester with test-runner
> Output:
> Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
>
> Failed Test Cases
> Read Exp Feature - Success Failed 0.107 seconds
> ##############################
> Test: TestRunner_sco-tester - FAIL
> Desc: Run sco-tester with test-runner
> Output:
> WARNING: possible circular locking dependency detected
> 7.0.0-rc2-g4eb3d58cb92c #1 Not tainted
> ------------------------------------------------------
> kworker/u5:2/117 is trying to acquire lock:
> ffff888001abe240 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x358/0x8d0
>
> but task is already holding lock:
> ffff888002090c20 (&conn->lock){+.+.}-{3:3}, at: sco_connect_cfm+0x22d/0x8d0
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #1 (&conn->lock){+.+.}-{3:3}:
> lock_acquire+0xf7/0x2c0
> _raw_spin_lock+0x2a/0x40
> sco_sock_connect+0x4d7/0x1280
> __sys_connect+0x1a3/0x260
> __x64_sys_connect+0x6e/0xb0
> do_syscall_64+0xa0/0x570
> entry_SYSCALL_64_after_hwframe+0x74/0x7c
>
> -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
> check_prev_add+0xe9/0xc70
> __lock_acquire+0x1457/0x1df0
> lock_acquire+0xf7/0x2c0
> lock_sock_nested+0x36/0xd0
> sco_connect_cfm+0x358/0x8d0
> hci_sync_conn_complete_evt+0x3d3/0x8e0
> hci_event_packet+0x74f/0xb10
> hci_rx_work+0x398/0xd00
> process_scheduled_works+0xb16/0x1ac0
> worker_thread+0x4ff/0xba0
> kthread+0x368/0x490
> ret_from_fork+0x498/0x7e0
> ret_from_fork_asm+0x19/0x30
>
> other info that might help us debug this:
>
> ...
> BUG: sleeping function called from invalid context at net/core/sock.c:3782
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 117, name: kworker/u5:2
> preempt_count: 1, expected: 0
> RCU nest depth: 0, expected: 0
> INFO: lockdep is turned off.
> CPU: 0 UID: 0 PID: 117 Comm: kworker/u5:2 Not tainted 7.0.0-rc2-g4eb3d58cb92c #1 PREEMPT(lazy)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> Workqueue: hci0 hci_rx_work
> Call Trace:
> <TASK>
> dump_stack_lvl+0x49/0x60
> __might_resched+0x2ea/0x500
> lock_sock_nested+0x47/0xd0
> ? sco_connect_cfm+0x358/0x8d0
> sco_connect_cfm+0x358/0x8d0
> ? hci_debugfs_create_conn+0x190/0x210
> ? __pfx_sco_connect_cfm+0x10/0x10
> hci_sync_conn_complete_evt+0x3d3/0x8e0
> hci_event_packet+0x74f/0xb10
> ? __pfx_hci_sync_conn_complete_evt+0x10/0x10
> ? __pfx_hci_event_packet+0x10/0x10
> ? mark_held_locks+0x49/0x80
> ? lockdep_hardirqs_on_prepare+0xd4/0x180
> ? _raw_spin_unlock_irqrestore+0x2c/0x50
> hci_rx_work+0x398/0xd00
> process_scheduled_works+0xb16/0x1ac0
> ? __pfx_process_scheduled_works+0x10/0x10
> ? lock_acquire+0xf7/0x2c0
> ? lock_is_held_type+0x9b/0x110
> ? __pfx_hci_rx_work+0x10/0x10
> worker_thread+0x4ff/0xba0
> ? _raw_spin_unlock_irqrestore+0x2c/0x50
> ? __pfx_worker_thread+0x10/0x10
> kthread+0x368/0x490
> ? _raw_spin_unlock_irq+0x23/0x40
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x498/0x7e0
> ? __pfx_ret_from_fork+0x10/0x10
> ? __switch_to+0x9e4/0xe50
> ? __switch_to_asm+0x32/0x60
> ...
> Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
> ##############################
> Test: TestRunner_mesh-tester - FAIL
> Desc: Run mesh-tester with test-runner
> Output:
> Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
>
> Failed Test Cases
> Mesh - Send cancel - 1 Timed out 1.859 seconds
> Mesh - Send cancel - 2 Timed out 1.996 seconds
> ##############################
> Test: TestRunner_6lowpan-tester - FAIL
> Desc: Run 6lowpan-tester with test-runner
> Output:
> WARNING: possible circular locking dependency detected
> 7.0.0-rc2-g4eb3d58cb92c #1 Not tainted
> ------------------------------------------------------
> kworker/0:1/11 is trying to acquire lock:
> ffff8880026e5140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x75/0x180
>
> but task is already holding lock:
> ffffffffb6e4d7a0 (rtnl_mutex){+.+.}-{4:4}, at: lowpan_unregister_netdev+0xd/0x30
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #4 (rtnl_mutex){+.+.}-{4:4}:
> lock_acquire+0xf7/0x2c0
> __mutex_lock+0x16b/0x1fc0
> lowpan_register_netdev+0x11/0x30
> chan_ready_cb+0x836/0xd00
> l2cap_recv_frame+0x6a06/0x8920
> l2cap_recv_acldata+0x790/0xdf0
> hci_rx_work+0x500/0xd00
> process_scheduled_works+0xb16/0x1ac0
> worker_thread+0x4ff/0xba0
> kthread+0x368/0x490
> ret_from_fork+0x498/0x7e0
> ret_from_fork_asm+0x19/0x30
>
> -> #3 (&chan->lock#3/1){+.+.}-{4:4}:
> lock_acquire+0xf7/0x2c0
> __mutex_lock+0x16b/0x1fc0
> l2cap_chan_connect+0x74e/0x1980
> lowpan_control_write+0x523/0x660
> full_proxy_write+0x10b/0x190
> vfs_write+0x1c0/0xf60
> ksys_write+0xf1/0x1d0
> do_syscall_64+0xa0/0x570
> entry_SYSCALL_64_after_hwframe+0x74/0x7c
>
> -> #2 (&conn->lock){+.+.}-{4:4}:
> ...
> Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
> ##############################
> Test: IncrementalBuild - PENDING
> Desc: Incremental build with the patches in the series
> Output:
>
>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_bluez_bluetooth-2Dnext_pull_56_checks&d=DwIFaQ&c=7dfBJ8cXbWjhc0BhImu8wVIoUFmBzj1s88r8EGyM0UY&r=_rvKD1lVMETnjfJne-APcrTZP0H9q0aBYQGmJWPSXJQ&m=OONH5zv5vMU43bEEZ3QknB0gB_vrzW9LOONd11Vx0z2qGVcvR94hfOX8xdyUbdlL&s=rpGqZ1uR_azOxaKMAqBf65sBjFIqPg5IPBQ2NIcisdY&e=
Ive got the following error while trying to apply this change:
Applying: Bluetooth: Add Synaptics 4384 Chip Support
WARNING: DT compatible string "brcm,bcm4384-bt" appears un-documented
-- check ./Documentation/devicetree/bindings/
#22: FILE: drivers/bluetooth/hci_bcm.c:1597:
+ { .compatible = "brcm,bcm4384-bt" },
--
Luiz Augusto von Dentz
^ permalink raw reply
* Re: [PATCH 4/9] dt-bindings: net: wireless: qcom,ath10k: Add NVMEM MAC address cell
From: Konrad Dybcio @ 2026-04-29 9:31 UTC (permalink / raw)
To: Loic Poulain, Ulf Hansson, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Jens Axboe,
Johannes Berg, Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
Cc: linux-mmc, devicetree, linux-kernel, linux-arm-msm, linux-block,
linux-wireless, ath10k, linux-bluetooth, netdev, daniel
In-Reply-To: <20260428-block-as-nvmem-v1-4-6ad23e75190a@oss.qualcomm.com>
On 4/28/26 4:23 PM, Loic Poulain wrote:
> Add support for an NVMEM cell provider with the standard "mac-address"
> cell name. This allows the ath10k device to retrieve its MAC address
> from non-volatile storage such as an EEPROM or an eMMC partition.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
> .../devicetree/bindings/net/wireless/qcom,ath10k.yaml | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> index c21d66c7cd558ab792524be9afec8b79272d1c87..7155d8b15cc145c3a7d703db0c9c3e056a54c07e 100644
> --- a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> +++ b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> @@ -92,6 +92,16 @@ properties:
>
> ieee80211-freq-limit: true
>
> + nvmem-cells:
> + maxItems: 1
> + description:
> + Nvmem data cell that contains a 6 byte MAC address with the most
> + significant byte first (big-endian).
> +
> + nvmem-cell-names:
> + items:
> + - const: mac-address
This can just be "const: mac-address" if you don't expect any additional
entries
Konrad
^ permalink raw reply
* Re: [PATCH 5/9] arm64: dts: qcom: arduino-imola: Get WiFi MAC from NVMEM
From: Konrad Dybcio @ 2026-04-29 9:30 UTC (permalink / raw)
To: Loic Poulain, Ulf Hansson, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Jens Axboe,
Johannes Berg, Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
Cc: linux-mmc, devicetree, linux-kernel, linux-arm-msm, linux-block,
linux-wireless, ath10k, linux-bluetooth, netdev, daniel
In-Reply-To: <20260428-block-as-nvmem-v1-5-6ad23e75190a@oss.qualcomm.com>
On 4/28/26 4:23 PM, Loic Poulain wrote:
> On Arduino Uno-Q, the WiFi MAC address is stored in the eMMC
> boot1 partition. Point to the appropriate NVMEM cell to
> retrieve it.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Konrad
^ permalink raw reply
* RE: client: Add public broadcast advertising support
From: bluez.test.bot @ 2026-04-29 9:21 UTC (permalink / raw)
To: linux-bluetooth, raghavendra.rao
In-Reply-To: <20260429074605.11774-2-raghavendra.rao@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 1790 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087302
---Test result---
Test Summary:
CheckPatch FAIL 1.13 seconds
GitLint PASS 0.69 seconds
BuildEll PASS 20.11 seconds
BluezMake PASS 648.01 seconds
CheckSmatch PASS 348.14 seconds
bluezmakeextell PASS 181.33 seconds
IncrementalBuild PASS 635.58 seconds
ScanBuild PASS 1013.92 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v5,1/2] client: add public-broadcast advertising command
WARNING:STATIC_CONST_CHAR_ARRAY: static const char * array should probably be static const char * const
#198: FILE: client/main.c:2923:
+static const char *public_broadcast_arguments[] = {
/github/workspace/src/patch/14546142.patch total: 0 errors, 1 warnings, 137 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14546142.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
https://github.com/bluez/bluez/pull/2083
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH 7/9] Bluetooth: hci_sync: Add NVMEM-backed BD address retrieval
From: Bartosz Golaszewski @ 2026-04-29 8:53 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Marcel Holtmann, Luiz Augusto von Dentz,
Balakrishna Godavarthi, Rocky Liao, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, linux-mmc, devicetree,
linux-kernel, linux-arm-msm, linux-block, linux-wireless, ath10k,
linux-bluetooth, netdev, daniel
In-Reply-To: <20260428-block-as-nvmem-v1-7-6ad23e75190a@oss.qualcomm.com>
On Tue, Apr 28, 2026 at 4:23 PM Loic Poulain
<loic.poulain@oss.qualcomm.com> wrote:
>
> Some devices store the Bluetooth BD address in non-volatile
> memory, which can be accessed through the NVMEM framework.
> Similar to Ethernet or WiFi MAC addresses, add support for
> reading the BD address from a 'local-bd-address' NVMEM cell.
>
> As with the device-tree provided BD address, add a quirk to
> indicate whether a device or platform should attempt to read
> the address from NVMEM when no valid in-chip address is present.
> Also add a quirk to indicate if the address is stored in
> big-endian byte order.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
Is there any reason why we can't extend the existing
of_get_mac_address() with another property name and use it here? It
already has support for mac addresses from nvmem.
Bart
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-04-29 8:33 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1086916
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-04-29 8:33 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087242
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 8782bd: client: add public-broadcast advertising command
From: raghava447 @ 2026-04-29 8:33 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087302
Home: https://github.com/bluez/bluez
Commit: 8782bd37d41050f7e67433bea2c2c4235f09772c
https://github.com/bluez/bluez/commit/8782bd37d41050f7e67433bea2c2c4235f09772c
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M client/advertising.c
M client/advertising.h
M client/main.c
Log Message:
-----------
client: add public-broadcast advertising command
Commit: b6850f0300f916c152f6f6f550ac6a815ce81e7a
https://github.com/bluez/bluez/commit/b6850f0300f916c152f6f6f550ac6a815ce81e7a
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M client/advertising.c
Log Message:
-----------
client: make advertise.name use public broadcast name
Compare: https://github.com/bluez/bluez/compare/8782bd37d410%5E...b6850f0300f9
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v5 2/2] client: make advertise.name use public broadcast name
From: raghu447 @ 2026-04-29 7:46 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260429074605.11774-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
---
client/advertising.c | 74 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 74 insertions(+)
diff --git a/client/advertising.c b/client/advertising.c
index 2fc2ac9c6..5ca391635 100644
--- a/client/advertising.c
+++ b/client/advertising.c
@@ -31,6 +31,7 @@
#define AD_PATH "/org/bluez/advertising"
#define AD_IFACE "org.bluez.LEAdvertisement1"
#define AD_PUBLIC_BROADCAST_UUID "0x1856"
+#define AD_TYPE_PUBLIC_BROADCAST_NAME 0x30
#define AD_PUBLIC_BROADCAST_SQ BIT(1)
#define AD_PUBLIC_BROADCAST_HQ BIT(2)
@@ -1016,6 +1017,62 @@ static bool ad_is_public_broadcast_uuid(const char *uuid)
return uuid && !bt_uuid_strcmp(uuid, AD_PUBLIC_BROADCAST_UUID);
}
+static bool ad_broadcast_in_use(void)
+{
+ return ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid);
+}
+
+static bool ad_has_public_broadcast_name(void)
+{
+ return ad.data[AD_TYPE_AD].valid &&
+ ad.data[AD_TYPE_AD].type == AD_TYPE_PUBLIC_BROADCAST_NAME &&
+ ad.data[AD_TYPE_AD].data.len > 0;
+}
+
+static void ad_print_public_broadcast_name(void)
+{
+ if (!ad_has_public_broadcast_name()) {
+ bt_shell_printf("Public Broadcast Name not set\n");
+ return;
+ }
+
+ bt_shell_printf("Public Broadcast Name: %.*s\n",
+ (int) ad.data[AD_TYPE_AD].data.len,
+ (char *) ad.data[AD_TYPE_AD].data.data);
+}
+
+static bool ad_set_public_broadcast_name(DBusConnection *conn,
+ const char *name)
+{
+ struct ad_data data;
+ size_t len;
+
+ if (!name || !strlen(name)) {
+ bt_shell_printf("Public Broadcast Name cannot be empty\n");
+ return false;
+ }
+
+ len = strlen(name);
+ if (len > sizeof(data.data)) {
+ bt_shell_printf("Public Broadcast Name too long\n");
+ return false;
+ }
+
+ memset(&data, 0, sizeof(data));
+ memcpy(data.data, name, len);
+ data.len = len;
+
+ ad_clear_data(AD_TYPE_AD);
+ ad.data[AD_TYPE_AD].valid = true;
+ ad.data[AD_TYPE_AD].type = AD_TYPE_PUBLIC_BROADCAST_NAME;
+ ad.data[AD_TYPE_AD].data = data;
+
+ g_dbus_emit_property_changed(conn, AD_PATH, AD_IFACE,
+ prop_names.data[AD_TYPE_AD]);
+
+ return true;
+}
+
static const char *ad_public_broadcast_state(void)
{
if (!ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid))
@@ -1203,6 +1260,23 @@ void ad_advertise_name(DBusConnection *conn, bool value)
void ad_advertise_local_name(DBusConnection *conn, const char *name)
{
+ if (ad_broadcast_in_use()) {
+ if (!name) {
+ ad_print_public_broadcast_name();
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
+ if (ad_has_public_broadcast_name() &&
+ ad.data[AD_TYPE_AD].data.len == strlen(name) &&
+ !memcmp(ad.data[AD_TYPE_AD].data.data, name, strlen(name)))
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+
+ if (!ad_set_public_broadcast_name(conn, name))
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
if (!name) {
if (ad.local_name)
bt_shell_printf("LocalName: %s\n", ad.local_name);
--
2.43.0
^ permalink raw reply related
* [PATCH BlueZ v5 1/2] client: add public-broadcast advertising command
From: raghu447 @ 2026-04-29 7:46 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260429074605.11774-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
---
client/advertising.c | 74 ++++++++++++++++++++++++++++++++++++++++++++
client/advertising.h | 2 ++
client/main.c | 19 ++++++++++++
3 files changed, 95 insertions(+)
diff --git a/client/advertising.c b/client/advertising.c
index f9df1b855..2fc2ac9c6 100644
--- a/client/advertising.c
+++ b/client/advertising.c
@@ -20,6 +20,9 @@
#include <string.h>
#include <errno.h>
+#include "bluetooth/bluetooth.h"
+#include "bluetooth/uuid.h"
+
#include "gdbus/gdbus.h"
#include "src/shared/util.h"
#include "src/shared/shell.h"
@@ -27,6 +30,9 @@
#define AD_PATH "/org/bluez/advertising"
#define AD_IFACE "org.bluez.LEAdvertisement1"
+#define AD_PUBLIC_BROADCAST_UUID "0x1856"
+#define AD_PUBLIC_BROADCAST_SQ BIT(1)
+#define AD_PUBLIC_BROADCAST_HQ BIT(2)
struct ad_data {
uint8_t data[245];
@@ -1005,6 +1011,74 @@ static void ad_clear_data(int type)
memset(&ad.data[type], 0, sizeof(ad.data[type]));
}
+static bool ad_is_public_broadcast_uuid(const char *uuid)
+{
+ return uuid && !bt_uuid_strcmp(uuid, AD_PUBLIC_BROADCAST_UUID);
+}
+
+static const char *ad_public_broadcast_state(void)
+{
+ if (!ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid))
+ return NULL;
+
+ if (ad.service[AD_TYPE_AD].data.len != 2)
+ return NULL;
+
+ if (ad.service[AD_TYPE_AD].data.data[0] == AD_PUBLIC_BROADCAST_SQ &&
+ ad.service[AD_TYPE_AD].data.data[1] == 0x00)
+ return "sq";
+
+ if (ad.service[AD_TYPE_AD].data.data[0] == AD_PUBLIC_BROADCAST_HQ &&
+ ad.service[AD_TYPE_AD].data.data[1] == 0x00)
+ return "hq";
+
+ return NULL;
+}
+
+void ad_advertise_public_broadcast(DBusConnection *conn, int argc, char *argv[])
+{
+ struct ad_data data = {
+ .data = { 0x00, 0x00 },
+ .len = 2,
+ };
+ const char *state;
+
+ if (argc < 2) {
+ state = ad_public_broadcast_state();
+ if (state)
+ bt_shell_printf("Public Broadcast: %s\n", state);
+ else
+ bt_shell_printf("Public Broadcast not set\n");
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
+ if (!strlen(argv[1])) {
+ bt_shell_printf("Public broadcast value cannot be empty\n");
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+ }
+
+ if (!strcasecmp(argv[1], "sq"))
+ data.data[0] = AD_PUBLIC_BROADCAST_SQ;
+ else if (!strcasecmp(argv[1], "hq"))
+ data.data[0] = AD_PUBLIC_BROADCAST_HQ;
+ else {
+ bt_shell_printf("Invalid argument: accepted values are "
+ "sq or hq\n");
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+ }
+
+ ad_clear_service(AD_TYPE_AD);
+
+ ad.service[AD_TYPE_AD].uuid = g_strdup(AD_PUBLIC_BROADCAST_UUID);
+ ad.service[AD_TYPE_AD].data = data;
+
+ g_dbus_emit_property_changed(conn, AD_PATH, AD_IFACE,
+ prop_names.service[AD_TYPE_AD]);
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+}
+
void ad_advertise_data(DBusConnection *conn, int type, int argc, char *argv[])
{
char *endptr = NULL;
diff --git a/client/advertising.h b/client/advertising.h
index 9d124c7af..8c3fd041b 100644
--- a/client/advertising.h
+++ b/client/advertising.h
@@ -34,6 +34,8 @@ void ad_advertise_local_appearance(DBusConnection *conn, long int *value);
void ad_advertise_duration(DBusConnection *conn, long int *value);
void ad_advertise_timeout(DBusConnection *conn, long int *value);
void ad_advertise_data(DBusConnection *conn, int type, int argc, char *argv[]);
+void ad_advertise_public_broadcast(DBusConnection *conn, int argc,
+ char *argv[]);
void ad_disable_data(DBusConnection *conn, int type);
void ad_advertise_discoverable(DBusConnection *conn, dbus_bool_t *value);
void ad_advertise_discoverable_timeout(DBusConnection *conn, long int *value);
diff --git a/client/main.c b/client/main.c
index 57fa13888..6fb399277 100644
--- a/client/main.c
+++ b/client/main.c
@@ -2920,6 +2920,17 @@ static char *scan_generator(const char *text, int state)
return argument_generator(text, state, scan_arguments);
}
+static const char *public_broadcast_arguments[] = {
+ "sq",
+ "hq",
+ NULL
+};
+
+static char *public_broadcast_generator(const char *text, int state)
+{
+ return argument_generator(text, state, public_broadcast_arguments);
+}
+
static void cmd_advertise(int argc, char *argv[])
{
dbus_bool_t enable;
@@ -2970,6 +2981,11 @@ static void cmd_advertise_data(int argc, char *argv[])
ad_advertise_data(dbus_conn, AD_TYPE_AD, argc, argv);
}
+static void cmd_advertise_public_broadcast(int argc, char *argv[])
+{
+ ad_advertise_public_broadcast(dbus_conn, argc, argv);
+}
+
static void cmd_advertise_sr_uuids(int argc, char *argv[])
{
ad_advertise_uuids(dbus_conn, AD_TYPE_SRD, argc, argv);
@@ -3653,6 +3669,9 @@ static const struct bt_shell_menu advertise_menu = {
"Set/Get advertise manufacturer data" },
{ "data", "[type] [data=xx xx ...]", cmd_advertise_data,
"Set/Get advertise data" },
+ { "public-broadcast", "[sq/hq]", cmd_advertise_public_broadcast,
+ "Set/Get BLE Audio Public Broadcast Announcement",
+ public_broadcast_generator },
{ "sr-uuids", "[uuid1 uuid2 ...]", cmd_advertise_sr_uuids,
"Set/Get scan response uuids" },
{ "sr-solicit", "[uuid1 uuid2 ...]", cmd_advertise_sr_solicit,
--
2.43.0
^ permalink raw reply related
* [PATCH BlueZ v5 0/2] client: Add public broadcast advertising support
From: raghu447 @ 2026-04-29 7:46 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghu447
In-Reply-To: <20260429061045.9115-2-raghavendra.rao@collabora.com>
This series adds bluetoothctl support for staging Public Broadcast
Announcement advertising data used during LE Audio public broadcast
qualification.
Patch 1 adds a public-broadcast command to the advertise submenu. The
command stages Public Broadcast Announcement ServiceData using UUID
0x1856 and supports SQ and HQ presets.
Patch 2 makes advertise.name broadcast-aware. When Public Broadcast
Announcement ServiceData is staged, advertise.name sets and gets the
Public Broadcast Name using AD type 0x30.
raghavendra (2):
client: add public-broadcast advertising command
client: make advertise.name use public broadcast name
client/advertising.c | 148 +++++++++++++++++++++++++++++++++++++++++++
client/advertising.h | 2 +
client/main.c | 19 ++++++
3 files changed, 169 insertions(+)
--
2.43.0
^ permalink raw reply
* RE: client: Add public broadcast advertising support
From: bluez.test.bot @ 2026-04-29 6:46 UTC (permalink / raw)
To: linux-bluetooth, raghavendra.rao
In-Reply-To: <20260429061045.9115-2-raghavendra.rao@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 36936 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087242
---Test result---
Test Summary:
CheckPatch PASS 0.82 seconds
GitLint PASS 0.49 seconds
BuildEll PASS 19.80 seconds
BluezMake FAIL 563.58 seconds
CheckSmatch FAIL 257.55 seconds
bluezmakeextell FAIL 149.41 seconds
IncrementalBuild FAIL 562.90 seconds
ScanBuild FAIL 297.84 seconds
Details
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12984:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12984 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%'
tools/sco-tester.c: note: in included file:
./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures
./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures
tools/bneptest.c:634:39: warning: unknown escape sequence: '\%'
tools/seq2bseq.c:57:26: warning: Variable length array is used.
tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/btpclient/gatt.c: note: in included file:
./src/shared/btp.h:328:41: warning: array of flexible structures
./src/shared/btp.h:333:55: warning: array of flexible structures
./src/shared/btp.h:356:47: warning: array of flexible structures
./src/shared/btp.h:385:42: warning: array of flexible structures
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
unit/avctp.c:505:34: warning: Variable length array is used.
unit/avctp.c:556:34: warning: Variable length array is used.
unit/test-avrcp.c:373:26: warning: Variable length array is used.
unit/test-avrcp.c:398:26: warning: Variable length array is used.
unit/test-avrcp.c:414:24: warning: Variable length array is used.
unit/avrcp-lib.c:1085:34: warning: Variable length array is used.
unit/avrcp-lib.c:1583:34: warning: Variable length array is used.
unit/avrcp-lib.c:1612:34: warning: Variable length array is used.
unit/avrcp-lib.c:1638:34: warning: Variable length array is used.
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/main.c: note: in included file (through src/device.h):
./src/shared/queue.h:19:20: error: redefinition of struct queue_entry
mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used.
client/display.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12984:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12984 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v4,1/2] client: add public-broadcast advertising command
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12984:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12984 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 6)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read
i = execvp(cmdargv[0], cmdargv);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull'
i = execvp(cmdargv[0], cmdargv);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined
req.channel = raddr.rc_channel;
^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value
sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int'
uint32_t *value_int = malloc(sizeof(int));
~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value
free(allocArray[i]);
^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name'
return add_service(0, &si);
^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc'
return -1;
^~~~~~~~~
4 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read
len = write(sk, buf, invalid ? 2 : 3);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 4 + media_transport_size);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read
len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull'
tcp_port = atoi(optarg);
^~~~~~~~~~~~
tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull'
if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3))
^~~~~~~~~~~~~~
2 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
4 warnings generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read
ptr = fgets(result, sizeof(result), fp);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read
argv += optind;
^ ~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read
argv -= optind;
^ ~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value
chr_write(chr, value, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_RDONLY | O_NOCTTY, 0);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read
bit = 0;
^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(cp->data, ad_data, ad_len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value
g_free(text[i]);
^~~~~~~~~~~~~~~
1 warning generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed
if (!cb->resume_cb)
^~~~~~~~~~~~~
profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream')
stream->starting = TRUE;
~~~~~~ ^
profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
if (!stream->suspending && stream->suspend_timer) {
^~~~~~~~~~~~~~~~~~
profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
stream->suspending = TRUE;
~~~~~~ ^
4 warnings generated.
profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read
operands += sizeof(*pdu);
^ ~~~~~~~~~~~~
1 warning generated.
attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write'
return prepare_write(long_write);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(to, from, count);
^~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
mesh/main.c:162:3: warning: Value stored to 'optarg' is never read
optarg += strlen("auto");
^ ~~~~~~~~~~~~~~
1 warning generated.
client/main.c: In function ‘public_broadcast_generator’:
client/main.c:2931:41: error: passing argument 3 of ‘argument_generator’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
2931 | return argument_generator(text, state, public_broadcast_arguments);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
client/main.c:2893:18: note: expected ‘const char **’ but argument is of type ‘const char * const*’
2893 | const char *args_list[])
| ~~~~~~~~~~~~^~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: client/main.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
https://github.com/bluez/bluez/pull/2082
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez] 69d9cd: client: add public-broadcast advertising command
From: raghava447 @ 2026-04-29 6:15 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087242
Home: https://github.com/bluez/bluez
Commit: 69d9cdab0db74e7d638cc2103c122fd358048b90
https://github.com/bluez/bluez/commit/69d9cdab0db74e7d638cc2103c122fd358048b90
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M client/advertising.c
M client/advertising.h
M client/main.c
Log Message:
-----------
client: add public-broadcast advertising command
Commit: a3c0f28d5f298887d7c190e64d8a483fd992ffaa
https://github.com/bluez/bluez/commit/a3c0f28d5f298887d7c190e64d8a483fd992ffaa
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M client/advertising.c
Log Message:
-----------
client: make advertise.name use public broadcast name
Compare: https://github.com/bluez/bluez/compare/69d9cdab0db7%5E...a3c0f28d5f29
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v4 2/2] client: make advertise.name use public broadcast name
From: raghu447 @ 2026-04-29 6:10 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260429061045.9115-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
---
client/advertising.c | 74 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 74 insertions(+)
diff --git a/client/advertising.c b/client/advertising.c
index 2fc2ac9c6..5ca391635 100644
--- a/client/advertising.c
+++ b/client/advertising.c
@@ -31,6 +31,7 @@
#define AD_PATH "/org/bluez/advertising"
#define AD_IFACE "org.bluez.LEAdvertisement1"
#define AD_PUBLIC_BROADCAST_UUID "0x1856"
+#define AD_TYPE_PUBLIC_BROADCAST_NAME 0x30
#define AD_PUBLIC_BROADCAST_SQ BIT(1)
#define AD_PUBLIC_BROADCAST_HQ BIT(2)
@@ -1016,6 +1017,62 @@ static bool ad_is_public_broadcast_uuid(const char *uuid)
return uuid && !bt_uuid_strcmp(uuid, AD_PUBLIC_BROADCAST_UUID);
}
+static bool ad_broadcast_in_use(void)
+{
+ return ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid);
+}
+
+static bool ad_has_public_broadcast_name(void)
+{
+ return ad.data[AD_TYPE_AD].valid &&
+ ad.data[AD_TYPE_AD].type == AD_TYPE_PUBLIC_BROADCAST_NAME &&
+ ad.data[AD_TYPE_AD].data.len > 0;
+}
+
+static void ad_print_public_broadcast_name(void)
+{
+ if (!ad_has_public_broadcast_name()) {
+ bt_shell_printf("Public Broadcast Name not set\n");
+ return;
+ }
+
+ bt_shell_printf("Public Broadcast Name: %.*s\n",
+ (int) ad.data[AD_TYPE_AD].data.len,
+ (char *) ad.data[AD_TYPE_AD].data.data);
+}
+
+static bool ad_set_public_broadcast_name(DBusConnection *conn,
+ const char *name)
+{
+ struct ad_data data;
+ size_t len;
+
+ if (!name || !strlen(name)) {
+ bt_shell_printf("Public Broadcast Name cannot be empty\n");
+ return false;
+ }
+
+ len = strlen(name);
+ if (len > sizeof(data.data)) {
+ bt_shell_printf("Public Broadcast Name too long\n");
+ return false;
+ }
+
+ memset(&data, 0, sizeof(data));
+ memcpy(data.data, name, len);
+ data.len = len;
+
+ ad_clear_data(AD_TYPE_AD);
+ ad.data[AD_TYPE_AD].valid = true;
+ ad.data[AD_TYPE_AD].type = AD_TYPE_PUBLIC_BROADCAST_NAME;
+ ad.data[AD_TYPE_AD].data = data;
+
+ g_dbus_emit_property_changed(conn, AD_PATH, AD_IFACE,
+ prop_names.data[AD_TYPE_AD]);
+
+ return true;
+}
+
static const char *ad_public_broadcast_state(void)
{
if (!ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid))
@@ -1203,6 +1260,23 @@ void ad_advertise_name(DBusConnection *conn, bool value)
void ad_advertise_local_name(DBusConnection *conn, const char *name)
{
+ if (ad_broadcast_in_use()) {
+ if (!name) {
+ ad_print_public_broadcast_name();
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
+ if (ad_has_public_broadcast_name() &&
+ ad.data[AD_TYPE_AD].data.len == strlen(name) &&
+ !memcmp(ad.data[AD_TYPE_AD].data.data, name, strlen(name)))
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+
+ if (!ad_set_public_broadcast_name(conn, name))
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
if (!name) {
if (ad.local_name)
bt_shell_printf("LocalName: %s\n", ad.local_name);
--
2.43.0
^ permalink raw reply related
* [PATCH BlueZ v4 1/2] client: add public-broadcast advertising command
From: raghu447 @ 2026-04-29 6:10 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260429061045.9115-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
---
client/advertising.c | 74 ++++++++++++++++++++++++++++++++++++++++++++
client/advertising.h | 2 ++
client/main.c | 19 ++++++++++++
3 files changed, 95 insertions(+)
diff --git a/client/advertising.c b/client/advertising.c
index f9df1b855..2fc2ac9c6 100644
--- a/client/advertising.c
+++ b/client/advertising.c
@@ -20,6 +20,9 @@
#include <string.h>
#include <errno.h>
+#include "bluetooth/bluetooth.h"
+#include "bluetooth/uuid.h"
+
#include "gdbus/gdbus.h"
#include "src/shared/util.h"
#include "src/shared/shell.h"
@@ -27,6 +30,9 @@
#define AD_PATH "/org/bluez/advertising"
#define AD_IFACE "org.bluez.LEAdvertisement1"
+#define AD_PUBLIC_BROADCAST_UUID "0x1856"
+#define AD_PUBLIC_BROADCAST_SQ BIT(1)
+#define AD_PUBLIC_BROADCAST_HQ BIT(2)
struct ad_data {
uint8_t data[245];
@@ -1005,6 +1011,74 @@ static void ad_clear_data(int type)
memset(&ad.data[type], 0, sizeof(ad.data[type]));
}
+static bool ad_is_public_broadcast_uuid(const char *uuid)
+{
+ return uuid && !bt_uuid_strcmp(uuid, AD_PUBLIC_BROADCAST_UUID);
+}
+
+static const char *ad_public_broadcast_state(void)
+{
+ if (!ad_is_public_broadcast_uuid(ad.service[AD_TYPE_AD].uuid))
+ return NULL;
+
+ if (ad.service[AD_TYPE_AD].data.len != 2)
+ return NULL;
+
+ if (ad.service[AD_TYPE_AD].data.data[0] == AD_PUBLIC_BROADCAST_SQ &&
+ ad.service[AD_TYPE_AD].data.data[1] == 0x00)
+ return "sq";
+
+ if (ad.service[AD_TYPE_AD].data.data[0] == AD_PUBLIC_BROADCAST_HQ &&
+ ad.service[AD_TYPE_AD].data.data[1] == 0x00)
+ return "hq";
+
+ return NULL;
+}
+
+void ad_advertise_public_broadcast(DBusConnection *conn, int argc, char *argv[])
+{
+ struct ad_data data = {
+ .data = { 0x00, 0x00 },
+ .len = 2,
+ };
+ const char *state;
+
+ if (argc < 2) {
+ state = ad_public_broadcast_state();
+ if (state)
+ bt_shell_printf("Public Broadcast: %s\n", state);
+ else
+ bt_shell_printf("Public Broadcast not set\n");
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+ }
+
+ if (!strlen(argv[1])) {
+ bt_shell_printf("Public broadcast value cannot be empty\n");
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+ }
+
+ if (!strcasecmp(argv[1], "sq"))
+ data.data[0] = AD_PUBLIC_BROADCAST_SQ;
+ else if (!strcasecmp(argv[1], "hq"))
+ data.data[0] = AD_PUBLIC_BROADCAST_HQ;
+ else {
+ bt_shell_printf("Invalid argument: accepted values are "
+ "sq or hq\n");
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
+ }
+
+ ad_clear_service(AD_TYPE_AD);
+
+ ad.service[AD_TYPE_AD].uuid = g_strdup(AD_PUBLIC_BROADCAST_UUID);
+ ad.service[AD_TYPE_AD].data = data;
+
+ g_dbus_emit_property_changed(conn, AD_PATH, AD_IFACE,
+ prop_names.service[AD_TYPE_AD]);
+
+ return bt_shell_noninteractive_quit(EXIT_SUCCESS);
+}
+
void ad_advertise_data(DBusConnection *conn, int type, int argc, char *argv[])
{
char *endptr = NULL;
diff --git a/client/advertising.h b/client/advertising.h
index 9d124c7af..8c3fd041b 100644
--- a/client/advertising.h
+++ b/client/advertising.h
@@ -34,6 +34,8 @@ void ad_advertise_local_appearance(DBusConnection *conn, long int *value);
void ad_advertise_duration(DBusConnection *conn, long int *value);
void ad_advertise_timeout(DBusConnection *conn, long int *value);
void ad_advertise_data(DBusConnection *conn, int type, int argc, char *argv[]);
+void ad_advertise_public_broadcast(DBusConnection *conn, int argc,
+ char *argv[]);
void ad_disable_data(DBusConnection *conn, int type);
void ad_advertise_discoverable(DBusConnection *conn, dbus_bool_t *value);
void ad_advertise_discoverable_timeout(DBusConnection *conn, long int *value);
diff --git a/client/main.c b/client/main.c
index 57fa13888..afaf6045b 100644
--- a/client/main.c
+++ b/client/main.c
@@ -2920,6 +2920,17 @@ static char *scan_generator(const char *text, int state)
return argument_generator(text, state, scan_arguments);
}
+static const char * const public_broadcast_arguments[] = {
+ "sq",
+ "hq",
+ NULL
+};
+
+static char *public_broadcast_generator(const char *text, int state)
+{
+ return argument_generator(text, state, public_broadcast_arguments);
+}
+
static void cmd_advertise(int argc, char *argv[])
{
dbus_bool_t enable;
@@ -2970,6 +2981,11 @@ static void cmd_advertise_data(int argc, char *argv[])
ad_advertise_data(dbus_conn, AD_TYPE_AD, argc, argv);
}
+static void cmd_advertise_public_broadcast(int argc, char *argv[])
+{
+ ad_advertise_public_broadcast(dbus_conn, argc, argv);
+}
+
static void cmd_advertise_sr_uuids(int argc, char *argv[])
{
ad_advertise_uuids(dbus_conn, AD_TYPE_SRD, argc, argv);
@@ -3653,6 +3669,9 @@ static const struct bt_shell_menu advertise_menu = {
"Set/Get advertise manufacturer data" },
{ "data", "[type] [data=xx xx ...]", cmd_advertise_data,
"Set/Get advertise data" },
+ { "public-broadcast", "[sq/hq]", cmd_advertise_public_broadcast,
+ "Set/Get BLE Audio Public Broadcast Announcement",
+ public_broadcast_generator },
{ "sr-uuids", "[uuid1 uuid2 ...]", cmd_advertise_sr_uuids,
"Set/Get scan response uuids" },
{ "sr-solicit", "[uuid1 uuid2 ...]", cmd_advertise_sr_solicit,
--
2.43.0
^ permalink raw reply related
* [PATCH BlueZ v4 0/2] client: Add public broadcast advertising support
From: raghu447 @ 2026-04-29 6:10 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghu447
In-Reply-To: <20260428144008.7487-2-raghavendra.rao@collabora.com>
This series adds bluetoothctl support for staging Public Broadcast
Announcement advertising data used during LE Audio public broadcast
qualification.
Patch 1 adds a public-broadcast command to the advertise submenu. The
command stages Public Broadcast Announcement ServiceData using UUID
0x1856 and supports SQ and HQ presets.
Patch 2 makes advertise.name broadcast-aware. When Public Broadcast
Announcement ServiceData is staged, advertise.name sets and gets the
Public Broadcast Name using AD type 0x30. Outside public broadcast mode,
the existing LocalName behavior is preserved.
raghavendra (2):
client: add public-broadcast advertising command
client: make advertise.name use public broadcast name
client/advertising.c | 148 +++++++++++++++++++++++++++++++++++++++++++
client/advertising.h | 2 +
client/main.c | 19 ++++++
3 files changed, 169 insertions(+)
--
2.43.0
^ permalink raw reply
* Re: [PATCH 0/9] Support for block device NVMEM providers
From: Andrew Lunn @ 2026-04-29 1:05 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-mmc, devicetree, linux-kernel, linux-arm-msm,
linux-block, linux-wireless, ath10k, linux-bluetooth, netdev,
daniel
In-Reply-To: <20260428-block-as-nvmem-v1-0-6ad23e75190a@oss.qualcomm.com>
> Note that this is currently limited to eMMC-backed block devices, as
> only the eMMC core associates a firmware node with the block device
> (add_disk_fwnode). This can be easily extended in the future to
> support additional block drivers.
Would this be
https://elixir.bootlin.com/linux/v7.0.1/source/drivers/mmc/core/block.c#L2641
Looking at that function, mmc_blk_alloc_req() i don't see it doing
anything different between an eMMC and MMC.
An eMMC you don't expect to go away, since it is soldered
down. However an MMC can be ejected. Is the code prepared for that?
Andrew
^ permalink raw reply
* RE: Bluetooth: l2cap: fix UAF race in l2cap_sock_cleanup_listen
From: bluez.test.bot @ 2026-04-29 0:37 UTC (permalink / raw)
To: linux-bluetooth, safa.karakus
In-Reply-To: <AS8P250MB079109F82C16BEDC4F9FE584EB372@AS8P250MB0791.EURP250.PROD.OUTLOOK.COM>
[-- Attachment #1: Type: text/plain, Size: 1800 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087159
---Test result---
Test Summary:
CheckPatch FAIL 0.68 seconds
GitLint PASS 0.29 seconds
SubjectPrefix PASS 0.11 seconds
BuildKernel PASS 26.11 seconds
CheckAllWarning PASS 28.61 seconds
CheckSparse PASS 27.17 seconds
BuildKernel32 PASS 24.89 seconds
TestRunnerSetup PASS 564.19 seconds
TestRunner_l2cap-tester PASS 27.43 seconds
IncrementalBuild PASS 24.06 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: l2cap: fix UAF race in l2cap_sock_cleanup_listen
WARNING: From:/Signed-off-by: email name mismatch: 'From: Safa Karakuş <safa.karakus@secunnix.com>' != 'Signed-off-by: Safa Karakus<safa.karakus@secunnix.com>'
total: 0 errors, 1 warnings, 0 checks, 33 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14545605.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
Wide character in print at /github/workspace/src/src/scripts/checkpatch.pl line 7853.
https://github.com/bluez/bluetooth-next/pull/129
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: l2cap: fix UAF race in l2cap_sock_cleanup_listen
From: Safa Karakuş @ 2026-04-28 23:30 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
Cc: marcel@holtmann.org, luiz.dentz@gmail.com, stable@vger.kernel.org
l2cap_sock_cleanup_listen() dequeues child sockets via
bt_accept_dequeue() without holding a reference on the returned sk.
A concurrent HCI disconnect can trigger l2cap_conn_del() on CPU1
which, while holding chan->lock, calls:
teardown_cb -> sock_set_flag(sk, SOCK_ZAPPED)
close_cb -> l2cap_sock_kill(sk) -> sock_put(sk) -> kfree(sk)
all before CPU0 has a chance to acquire chan->lock. CPU0 then calls
l2cap_chan_lock() on the now-freed sk's chan (already safe because
l2cap_chan_hold() was called first) but subsequently passes the freed
sk pointer to l2cap_sock_kill(), causing a use-after-free read on
sk->sk_flags and sk->sk_socket.
Fix by calling sock_hold() immediately after bt_accept_dequeue() to
prevent kfree(sk) from racing with our traversal. After acquiring
chan->lock, check SOCK_DEAD: if l2cap_conn_del() already invoked
l2cap_sock_kill() (which sets SOCK_DEAD), skip the duplicate call to
avoid a double sock_put(). Drop the extra reference with sock_put()
at the end of each loop iteration.
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Cc: stable@vger.kernel.org
Signed-off-by: Safa Karakus<safa.karakus@secunnix.com>
---
net/bluetooth/l2cap_sock.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 71e8c1b45..4475d3377 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1477,7 +1477,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
/* Close not yet accepted channels */
while ((sk = bt_accept_dequeue(parent, NULL))) {
- struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+ struct l2cap_chan *chan;
+
+ /* Hold sk across the chan->lock acquisition window.
+ * A concurrent l2cap_conn_del() can call l2cap_sock_kill(sk)
+ * -> kfree(sk) inside chan->lock before we acquire it,
+ * leaving a dangling pointer.
+ */
+ sock_hold(sk);
+ chan = l2cap_pi(sk)->chan;
BT_DBG("child chan %p state %s", chan,
state_to_string(chan->state));
@@ -1487,10 +1495,16 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
__clear_chan_timer(chan);
l2cap_chan_close(chan, ECONNRESET);
- l2cap_sock_kill(sk);
+ /* l2cap_conn_del() may have already called l2cap_sock_kill()
+ * (setting SOCK_DEAD); skip the duplicate to avoid a
+ * double sock_put().
+ */
+ if (!sock_flag(sk, SOCK_DEAD))
+ l2cap_sock_kill(sk);
l2cap_chan_unlock(chan);
l2cap_chan_put(chan);
+ sock_put(sk);
}
}
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox