* Re: [RFC PATCH BlueZ] monitor: Fix RAS CS step mode parsing issues
From: patchwork-bot+bluetooth @ 2026-05-12 19:20 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <20260508191728.428868-1-luiz.dentz@gmail.com>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Fri, 8 May 2026 15:17:28 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> Fix double space typo in print_ranging_steps signature.
>
> Fix ToA_ToD sign extension using proper cast via (uint32_t)(int16_t)
> instead of unconditionally OR-ing with 0xFFFF0000 which corrupts
> positive values.
>
> [...]
Here is the summary with links:
- [RFC,BlueZ] monitor: Fix RAS CS step mode parsing issues
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=4cedd8f9b886
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [BlueZ v3 0/6] Add helper for "cleanup" variable attribute
From: patchwork-bot+bluetooth @ 2026-05-12 19:20 UTC (permalink / raw)
To: Bastien Nocera; +Cc: linux-bluetooth
In-Reply-To: <20260511132131.1283892-1-hadess@hadess.net>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 11 May 2026 15:18:03 +0200 you wrote:
> As discussed in:
> https://lore.kernel.org/linux-bluetooth/ed949f2550f79a4bef19bd482bf8b069ad5b7e0c.camel@hadess.net/
>
> Implement a cleanup helper.
>
> The MIN/MAX fix is here because it touches the same hunk in src/main.c
> as the other patches. Feel free to pick it up straight away while the
> rest is discussed.
>
> [...]
Here is the summary with links:
- [BlueZ,v3,1/6] all: Remove more unneeded MIN/MAX macro definition
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ca2b39b0c08e
- [BlueZ,v3,2/6] shared/util: Add helper for "cleanup" variable attribute
(no matching commit)
- [BlueZ,v3,3/6] doc: Recommend using _cleanup_ and friends
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=9ba6c13df5fb
- [BlueZ,v3,4/6] main: Use _cleanup_() to simplify configuration parsing
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=140e3569295c
- [BlueZ,v3,5/6] client: Use _cleanup_fd_ to simplify urandom access
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=e33f5027b898
- [BlueZ,v3,6/6] btattach: Use _cleanup_fd_ to simplify error paths
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=02aa9a8cfe6a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [BlueZ 1/3] mesh: Remove unused but set variable
From: patchwork-bot+bluetooth @ 2026-05-12 19:20 UTC (permalink / raw)
To: Bastien Nocera; +Cc: linux-bluetooth
In-Reply-To: <20260511113511.1217887-1-hadess@hadess.net>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 11 May 2026 13:35:05 +0200 you wrote:
> We played around with the bits, but didn't do anything with it.
>
> mesh/net.c: In function ‘ack_received’:
> mesh/net.c:1569:18: error: variable ‘ack_copy’ set but not used [-Werror=unused-but-set-variable=]
> 1569 | uint32_t ack_copy = ack_flag;
> | ^~~~~~~~
>
> [...]
Here is the summary with links:
- [BlueZ,1/3] mesh: Remove unused but set variable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=f95b524e5a1d
- [BlueZ,2/3] mesh: Fix str{r,}chr usage
(no matching commit)
- [BlueZ,3/3] mesh: Fix const qualifier dropping when using strchr()
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7b2b51ac6f64
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH BlueZ] adapter: add BCAA UUID also when seen device is not discoverable
From: patchwork-bot+bluetooth @ 2026-05-12 19:20 UTC (permalink / raw)
To: Pauli Virtanen; +Cc: linux-bluetooth
In-Reply-To: <a03d5b481c87d86d2bd2bdb376729ea6c4f992a9.1778535912.git.pav@iki.fi>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 12 May 2026 00:54:47 +0300 you wrote:
> BAP v1.0.2 Sec 6.4 specifies Broadcast discovery uses observation
> procedure (Core Vol 3 Part C Sec 9.1.2) which makes no reference to
> device discoverability state.
>
> However, if remote device does:
>
> 1. Send Advertising Data for some other UUID with General Discoverable
> 2. Send Advertising Data for BCAA UUID with no flags
>
> [...]
Here is the summary with links:
- [BlueZ] adapter: add BCAA UUID also when seen device is not discoverable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ec223f0782ef
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v2 0/6] Bluetooth: convert remaining bluetooth socket families to getsockopt_iter
From: patchwork-bot+bluetooth @ 2026-05-12 17:50 UTC (permalink / raw)
To: Breno Leitao
Cc: marcel, luiz.dentz, davem, edumazet, kuba, pabeni, horms, shuah,
linux-bluetooth, linux-kernel, netdev, linux-kselftest
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 12 May 2026 04:12:15 -0700 you wrote:
> Continue the conversion to .getsockopt_iter for the Bluetooth socket
> families: hci_sock, ISO, RFCOMM, SCO and L2CAP. The first patch is a
> small precursor that fixes a long-standing 1-byte put_user write in
> hci_sock_getsockopt_old() so the subsequent conversion stays mechanical.
>
> The riskiest change in this series is the SCO BT_CODEC conversion: it
> is the only one that drops an open-coded ptr cursor in favour of
> relying on iter_out advancing naturally on every copy_to_iter() call.
> Every other socket option is a near-mechanical s/copy_to_user/
> copy_to_iter/ rewrite, but BT_CODEC walks a variable-length list of
> codecs + capabilities and previously tracked its own write offset by
> hand. Getting the cursor semantics wrong here would silently truncate
> or misalign user-visible codec data.
>
> [...]
Here is the summary with links:
- [net-next,v2,1/6] Bluetooth: hci_sock: write the full optval for getsockopt
https://git.kernel.org/bluetooth/bluetooth-next/c/375386737970
- [net-next,v2,2/6] Bluetooth: hci_sock: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/317bb006946a
- [net-next,v2,3/6] Bluetooth: ISO: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/2b650bf299b6
- [net-next,v2,4/6] Bluetooth: RFCOMM: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/477cbdca7568
- [net-next,v2,5/6] Bluetooth: L2CAP: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/fcadc2780bf2
- [net-next,v2,6/6] Bluetooth: SCO: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/ff2e1268ee45
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 0/7] net: convert remaining bluetooth socket families to getsockopt_iter
From: patchwork-bot+bluetooth @ 2026-05-12 17:50 UTC (permalink / raw)
To: Breno Leitao
Cc: marcel, luiz.dentz, davem, edumazet, kuba, pabeni, horms, shuah,
linux-bluetooth, linux-kernel, netdev, linux-kselftest,
kernel-team
In-Reply-To: <20260511-getsock_three-v1-0-1461fa8786ab@debian.org>
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 11 May 2026 03:41:45 -0700 you wrote:
> Continue the conversion to .getsockopt_iter for the Bluetooth socket
> families: hci_sock, ISO, RFCOMM, SCO and L2CAP. The first patch is a
> small precursor that fixes a long-standing 1-byte put_user write in
> hci_sock_getsockopt_old() so the subsequent conversion stays mechanical.
>
> The riskiest change in this series is the SCO BT_CODEC conversion: it
> is the only one that drops an open-coded ptr cursor in favour of
> relying on iter_out advancing naturally on every copy_to_iter() call.
> Every other socket option is a near-mechanical s/copy_to_user/
> copy_to_iter/ rewrite, but BT_CODEC walks a variable-length list of
> codecs + capabilities and previously tracked its own write offset by
> hand. Getting the cursor semantics wrong here would silently truncate
> or misalign user-visible codec data.
>
> [...]
Here is the summary with links:
- [net-next,1/7] Bluetooth: hci_sock: write the full optval for getsockopt
https://git.kernel.org/bluetooth/bluetooth-next/c/375386737970
- [net-next,2/7] Bluetooth: hci_sock: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/317bb006946a
- [net-next,3/7] Bluetooth: ISO: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/2b650bf299b6
- [net-next,4/7] Bluetooth: RFCOMM: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/477cbdca7568
- [net-next,5/7] Bluetooth: L2CAP: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/fcadc2780bf2
- [net-next,6/7] selftests: net: getsockopt_iter: cover SCO BT_CODEC conversion
(no matching commit)
- [net-next,7/7] Bluetooth: SCO: convert to getsockopt_iter
https://git.kernel.org/bluetooth/bluetooth-next/c/ff2e1268ee45
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1] Bluetooth: btintel_pcie: Simplify MAC access request/release
From: Luiz Augusto von Dentz @ 2026-05-12 16:46 UTC (permalink / raw)
To: Kiran K; +Cc: linux-bluetooth, ravishankar.srivatsa, chethan.tumkur.narayan
In-Reply-To: <20260511133932.1217624-1-kiran.k@intel.com>
Hi Kiran,
On Mon, May 11, 2026 at 9:26 AM Kiran K <kiran.k@intel.com> wrote:
>
> Drop the STOP_MAC_ACCESS_DIS and XTAL_CLK_REQ bit manipulations from
> btintel_pcie_get_mac_access() and btintel_pcie_release_mac_access().
> These bits are no longer required to be toggled by the host driver for
> MAC access on the supported parts; the controller manages them
> internally.
>
> Also fix the idempotency check in btintel_pcie_get_mac_access(): only
> assert MAC_ACCESS_REQ if it is not already set, instead of keying the
> read-modify-write off the MAC_ACCESS_STS bit (which reflects grant,
> not request, state).
>
> Remove the now-unused STOP_MAC_ACCESS_DIS and XTAL_CLK_REQ register
> defines from btintel_pcie.h.
>
> Signed-off-by: Kiran K <kiran.k@intel.com>
> ---
> drivers/bluetooth/btintel_pcie.c | 10 +---------
> drivers/bluetooth/btintel_pcie.h | 3 ---
> 2 files changed, 1 insertion(+), 12 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index fda474406003..53a4ad80b871 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -594,9 +594,7 @@ static int btintel_pcie_get_mac_access(struct btintel_pcie_data *data)
>
> reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
>
> - reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS;
> - reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ;
> - if ((reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS) == 0)
> + if (!(reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ))
> reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ;
>
> btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
> @@ -622,12 +620,6 @@ static void btintel_pcie_release_mac_access(struct btintel_pcie_data *data)
> if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ)
> reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ;
>
> - if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS)
> - reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS;
> -
> - if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ)
> - reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ;
> -
> btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
Seem valid to me:
https://sashiko.dev/#/patchset/20260511133932.1217624-1-kiran.k%40intel.com
We could check; if no change is necessary, we can bail out early.
> }
>
> diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h
> index 2db85f71b2f8..7fc8c46ed689 100644
> --- a/drivers/bluetooth/btintel_pcie.h
> +++ b/drivers/bluetooth/btintel_pcie.h
> @@ -34,9 +34,6 @@
> #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS (BIT(20))
>
> #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ (BIT(21))
> -/* Stop MAC Access disconnection request */
> -#define BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS (BIT(22))
> -#define BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ (BIT(23))
>
> #define BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_STS (BIT(28))
> #define BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON (BIT(29))
> --
> 2.53.0
>
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* Re: [PATCH v1] Bluetooth: btintel_pcie: Reset controller before configuring MSI-X
From: Luiz Augusto von Dentz @ 2026-05-12 16:41 UTC (permalink / raw)
To: Kiran K
Cc: linux-bluetooth, ravishankar.srivatsa, chethan.tumkur.narayan,
aluvala.sai.teja
In-Reply-To: <20260511132711.1216139-1-kiran.k@intel.com>
Hi Kiran,
On Mon, May 11, 2026 at 9:11 AM Kiran K <kiran.k@intel.com> wrote:
>
> From: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
>
> Perform the shared hardware reset in btintel_pcie_probe() before
> configuring MSI-X so the controller starts from a known clean state.
>
> While here, move btintel_pcie_config_msix() out of
> btintel_pcie_config_pcie() and into the probe sequence, and propagate
> errors from btintel_pcie_reset_bt() so probe fails cleanly if the
> shared HW reset does not complete.
>
> Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
> Signed-off-by: Kiran K <kiran.k@intel.com>
> ---
> drivers/bluetooth/btintel_pcie.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index fda474406003..6ff08de9ec78 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -1646,9 +1646,6 @@ static int btintel_pcie_config_pcie(struct pci_dev *pdev,
> if (err)
> return err;
>
> - /* Configure MSI-X with causes list */
> - btintel_pcie_config_msix(data);
> -
> return 0;
> }
>
> @@ -2659,6 +2656,14 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
> if (err)
> goto exit_error;
>
> + err = btintel_pcie_reset_bt(data);
> + if (err) {
> + dev_err(&pdev->dev, "Bluetooth shared HW reset failed (%d)\n", err);
> + goto exit_error;
> + }
> +
> + /* Configure MSI-X with causes list */
> + btintel_pcie_config_msix(data);
Sashiko raised several comments on this:
https://sashiko.dev/#/patchset/20260511132711.1216139-1-kiran.k%40intel.com
> pci_set_drvdata(pdev, data);
>
> err = btintel_pcie_alloc(data);
> --
> 2.53.0
>
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* RE: Bluetooth: convert remaining bluetooth socket families to getsockopt_iter
From: bluez.test.bot @ 2026-05-12 13:44 UTC (permalink / raw)
To: linux-bluetooth, leitao
In-Reply-To: <20260512-getsock_three-v2-1-30b7b22ef14c@debian.org>
[-- Attachment #1: Type: text/plain, Size: 1482 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1093480
---Test result---
Test Summary:
CheckPatch PASS 4.19 seconds
GitLint PASS 1.80 seconds
SubjectPrefix PASS 0.76 seconds
BuildKernel PASS 27.64 seconds
CheckAllWarning PASS 30.79 seconds
CheckSparse PASS 29.76 seconds
BuildKernel32 PASS 26.88 seconds
TestRunnerSetup PASS 569.83 seconds
TestRunner_l2cap-tester PASS 378.12 seconds
TestRunner_iso-tester PASS 597.45 seconds
TestRunner_bnep-tester PASS 19.24 seconds
TestRunner_mgmt-tester PASS 2023.41 seconds
TestRunner_rfcomm-tester PASS 63.64 seconds
TestRunner_sco-tester PASS 141.77 seconds
TestRunner_ioctl-tester PASS 133.80 seconds
TestRunner_mesh-tester PASS 60.07 seconds
TestRunner_smp-tester PASS 18.27 seconds
TestRunner_userchan-tester PASS 19.60 seconds
TestRunner_6lowpan-tester PASS 51.45 seconds
IncrementalBuild PASS 35.29 seconds
https://github.com/bluez/bluetooth-next/pull/178
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [PATCH v1] Bluetooth: btintel_pcie: Simplify MAC access request/release
From: K, Kiran @ 2026-05-12 13:39 UTC (permalink / raw)
To: Paul Menzel
Cc: linux-bluetooth@vger.kernel.org, Srivatsa, Ravishankar,
Tumkur Narayan, Chethan
In-Reply-To: <4c1fb760-55b5-4392-9c89-7c8a3ce5201c@molgen.mpg.de>
Hi Paul,
Thanks for the comments.
>Subject: Re: [PATCH v1] Bluetooth: btintel_pcie: Simplify MAC access
>request/release
>
>Dear Kiran,
>
>
>Thank yuo for your patch.
>
>Am 11.05.26 um 15:39 schrieb Kiran K:
>> Drop the STOP_MAC_ACCESS_DIS and XTAL_CLK_REQ bit manipulations from
>> btintel_pcie_get_mac_access() and btintel_pcie_release_mac_access().
>> These bits are no longer required to be toggled by the host driver for
>> MAC access on the supported parts; the controller manages them
>> internally.
>
>Does the “no longer” refer to some controller firmware update? Please
>elaborate. (I personally prefer that as much as possible is done outside the
>firmware.) Also, maybe be explicit, and mention, if having the code has any
>practical downsides.
No, the “no longer” does not refer to any controller firmware update. The changes are relevant only to the driver. The driver now correctly programs a few registers before accessing the debug-related registers. Previously, it was programming these bits incorrectly, which prevented access to the debug registers during stress tests and caused device coredump failures.
>
>> Also fix the idempotency check in btintel_pcie_get_mac_access(): only
>> assert MAC_ACCESS_REQ if it is not already set, instead of keying the
>> read-modify-write off the MAC_ACCESS_STS bit (which reflects grant,
>> not request, state).
>
>*Also* is a good indicator to make something a separate commit. Any reason to
>not do it?
I kept the fix in the same patch because btintel_pcie_release_mac_access() is meant to undo what btintel_pcie_get_mac_access() does. Splitting them would break the pairing of get/release operations, so I felt it was logically one change.
>
>> Remove the now-unused STOP_MAC_ACCESS_DIS and XTAL_CLK_REQ register
>> defines from btintel_pcie.h.
>>
>> Signed-off-by: Kiran K <kiran.k@intel.com>
>
>No Fixes: tag? At least the second issue sounds like something to backport.
I will add appropriate Fixes: tags and send a v2.
>
>> ---
>> drivers/bluetooth/btintel_pcie.c | 10 +---------
>> drivers/bluetooth/btintel_pcie.h | 3 ---
>> 2 files changed, 1 insertion(+), 12 deletions(-)
>>
>> diff --git a/drivers/bluetooth/btintel_pcie.c
>> b/drivers/bluetooth/btintel_pcie.c
>> index fda474406003..53a4ad80b871 100644
>> --- a/drivers/bluetooth/btintel_pcie.c
>> +++ b/drivers/bluetooth/btintel_pcie.c
>> @@ -594,9 +594,7 @@ static int btintel_pcie_get_mac_access(struct
>> btintel_pcie_data *data)
>>
>> reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
>>
>> - reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS;
>> - reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ;
>> - if ((reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS) == 0)
>> + if (!(reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ))
>> reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ;
>>
>> btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
>> @@ -622,12 +620,6 @@ static void btintel_pcie_release_mac_access(struct
>btintel_pcie_data *data)
>> if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ)
>> reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ;
>>
>> - if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS)
>> - reg &=
>~BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS;
>> -
>> - if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ)
>> - reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ;
>> -
>> btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
>> }
>>
>> diff --git a/drivers/bluetooth/btintel_pcie.h
>> b/drivers/bluetooth/btintel_pcie.h
>> index 2db85f71b2f8..7fc8c46ed689 100644
>> --- a/drivers/bluetooth/btintel_pcie.h
>> +++ b/drivers/bluetooth/btintel_pcie.h
>> @@ -34,9 +34,6 @@
>> #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS (BIT(20))
>>
>> #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ (BIT(21))
>> -/* Stop MAC Access disconnection request */
>> -#define BTINTEL_PCIE_CSR_FUNC_CTRL_STOP_MAC_ACCESS_DIS
> (BIT(22))
>> -#define BTINTEL_PCIE_CSR_FUNC_CTRL_XTAL_CLK_REQ
> (BIT(23))
>>
>> #define BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_STS (BIT(28))
>> #define BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON
> (BIT(29))
>
>The diff looks good.
>
>
>Kind regards,
>
>Paul
Thanks,
Kiran
^ permalink raw reply
* RE: [RFC,BlueZ] media: Fix possible crash on exit/adapter removal
From: bluez.test.bot @ 2026-05-12 12:26 UTC (permalink / raw)
To: linux-bluetooth, hadess
In-Reply-To: <20260512101431.2017966-1-hadess@hadess.net>
[-- Attachment #1: Type: text/plain, Size: 989 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1093445
---Test result---
Test Summary:
CheckPatch PASS 0.43 seconds
GitLint PASS 0.29 seconds
BuildEll PASS 20.29 seconds
BluezMake PASS 657.53 seconds
MakeCheck PASS 2.98 seconds
MakeDistcheck PASS 246.45 seconds
CheckValgrind PASS 226.08 seconds
CheckSmatch PASS 350.07 seconds
bluezmakeextell PASS 181.48 seconds
IncrementalBuild PASS 664.24 seconds
ScanBuild PASS 1027.26 seconds
https://github.com/bluez/bluez/pull/2122
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez] c915f8: media: Fix possible crash on exit/adapter removal
From: hadess @ 2026-05-12 11:29 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1093445
Home: https://github.com/bluez/bluez
Commit: c915f8eb390fba5588ce1425025d4a4274a3fbed
https://github.com/bluez/bluez/commit/c915f8eb390fba5588ce1425025d4a4274a3fbed
Author: Bastien Nocera <hadess@hadess.net>
Date: 2026-05-12 (Tue, 12 May 2026)
Changed paths:
M profiles/audio/media.c
Log Message:
-----------
media: Fix possible crash on exit/adapter removal
Nothing protects media_endpoint_remove() from being called multiple
times for the same structure. Before a g_free() call is made on
endpoint->capabilities, there are NULL checks, and NULL setting,
for every variable that might get modified, so a second call to the same
function, even though it's still using-after-free, is only
reading-after-free, and might crash at the first attempt at modifying
that freed memory.
The reason why this function might be called multiple times is because
in some circumstances, another signal might be received that the
endpoint is getting removed while we're already in the process of
removing that endpoint.
For example, release_endpoint() (which should appear in between
path_free() and media_endpoint_remove() in the below backtrace, as
that's the function called at profiles/audio/media.c:3651), will send a
D-Bus message which it then waits for the answer to, meaning that other
D-Bus message could be received while we're waiting for the answer, and
then destroying the endpoint.
#11 media_endpoint_destroy at profiles/audio/media.c:231
#12 media_endpoint_remove at profiles/audio/media.c:314
#13 path_free at profiles/audio/media.c:3651
#14 remove_interface at gdbus/object.c:742
#15 g_dbus_unregister_interface at gdbus/object.c:1499
#16 g_slist_foreach at ../glib/gslist.c:837
#17 unload_drivers at src/adapter.c:5932
#18 adapter_remove at src/adapter.c:7088
#19 adapter_unregister at src/adapter.c:9504
#20 index_removed at src/adapter.c:10693
#21 queue_foreach at src/shared/queue.c:207
#23 process_notify at src/shared/mgmt.c:349
#24 can_read_data at src/shared/mgmt.c:409
#25 watch_callback at src/shared/io-glib.c:173
#27 g_main_context_dispatch_unlocked at ../glib/gmain.c:4451
#28 g_main_context_iterate_unlocked at ../glib/gmain.c:4516
#30 mainloop_run at src/shared/mainloop-glib.c:65
#31 mainloop_run_with_signal at src/shared/mainloop-notify.c:196
in profiles/audio/media.c:
231 g_free(endpoint->capabilities);
See https://bugzilla.redhat.com/show_bug.cgi?id=2467980
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH net-next v2 6/6] Bluetooth: SCO: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Convert SCO socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- Drop the open-coded ptr cursor in BT_CODEC; iter_out advances on
every copy_to_iter() naturally
- Add linux/uio.h for copy_to_iter()
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/sco.c | 59 ++++++++++++++++++++++++++++-------------------------
1 file changed, 31 insertions(+), 28 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index eba44525d41d9..37dcba9edfab6 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -28,6 +28,7 @@
#include <linux/debugfs.h>
#include <linux/seq_file.h>
#include <linux/sched/signal.h>
+#include <linux/uio.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -1072,7 +1073,7 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
}
static int sco_sock_getsockopt_old(struct socket *sock, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
struct sco_options opts;
@@ -1082,8 +1083,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname,
BT_DBG("sk %p", sk);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
lock_sock(sk);
@@ -1101,7 +1101,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname,
BT_DBG("mtu %u", opts.mtu);
len = min(len, sizeof(opts));
- if (copy_to_user(optval, (char *)&opts, len))
+ if (copy_to_iter(&opts, len, &opt->iter_out) != len)
err = -EFAULT;
break;
@@ -1119,7 +1119,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname,
memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
len = min(len, sizeof(cinfo));
- if (copy_to_user(optval, (char *)&cinfo, len))
+ if (copy_to_iter(&cinfo, len, &opt->iter_out) != len)
err = -EFAULT;
break;
@@ -1134,15 +1134,15 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname,
}
static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
- int len, err = 0;
+ int len, val, err = 0;
struct bt_voice voice;
u32 phys;
int buf_len;
struct codec_list *c;
- u8 num_codecs, i, __user *ptr;
+ u8 num_codecs, i;
struct hci_dev *hdev;
struct hci_codec_caps *caps;
struct bt_codec codec;
@@ -1150,10 +1150,9 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
BT_DBG("sk %p", sk);
if (level == SOL_SCO)
- return sco_sock_getsockopt_old(sock, optname, optval, optlen);
+ return sco_sock_getsockopt_old(sock, optname, opt);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
lock_sock(sk);
@@ -1165,8 +1164,9 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
- (u32 __user *)optval))
+ val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+ if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
+ sizeof(val))
err = -EFAULT;
break;
@@ -1175,7 +1175,7 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
voice.setting = sco_pi(sk)->setting;
len = min_t(unsigned int, len, sizeof(voice));
- if (copy_to_user(optval, (char *)&voice, len))
+ if (copy_to_iter(&voice, len, &opt->iter_out) != len)
err = -EFAULT;
break;
@@ -1188,13 +1188,15 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
- if (put_user(phys, (u32 __user *) optval))
+ if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) !=
+ sizeof(phys))
err = -EFAULT;
break;
case BT_PKT_STATUS:
- if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
- (int __user *)optval))
+ val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
+ if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
+ sizeof(val))
err = -EFAULT;
break;
@@ -1205,7 +1207,9 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
+ val = sco_pi(sk)->conn->mtu;
+ if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
+ sizeof(val))
err = -EFAULT;
break;
@@ -1252,13 +1256,12 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
hci_dev_put(hdev);
return -ENOBUFS;
}
- ptr = optval;
- if (put_user(num_codecs, ptr)) {
+ if (copy_to_iter(&num_codecs, sizeof(num_codecs),
+ &opt->iter_out) != sizeof(num_codecs)) {
hci_dev_put(hdev);
return -EFAULT;
}
- ptr += sizeof(num_codecs);
/* Iterate all the codecs supported over SCO and populate
* codec data
@@ -1275,11 +1278,11 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
if (err < 0)
break;
codec.num_caps = c->num_caps;
- if (copy_to_user(ptr, &codec, sizeof(codec))) {
+ if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out)
+ != sizeof(codec)) {
err = -EFAULT;
break;
}
- ptr += sizeof(codec);
/* find codec capabilities data length */
len = 0;
@@ -1289,11 +1292,11 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
}
/* copy codec capabilities data */
- if (len && copy_to_user(ptr, c->caps, len)) {
+ if (len &&
+ copy_to_iter(c->caps, len, &opt->iter_out) != len) {
err = -EFAULT;
break;
}
- ptr += len;
}
hci_dev_unlock(hdev);
@@ -1301,8 +1304,8 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
lock_sock(sk);
- if (!err && put_user(buf_len, optlen))
- err = -EFAULT;
+ if (!err)
+ opt->optlen = buf_len;
break;
@@ -1577,7 +1580,7 @@ static const struct proto_ops sco_sock_ops = {
.socketpair = sock_no_socketpair,
.shutdown = sco_sock_shutdown,
.setsockopt = sco_sock_setsockopt,
- .getsockopt = sco_sock_getsockopt
+ .getsockopt_iter = sco_sock_getsockopt
};
static const struct net_proto_family sco_sock_family_ops = {
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 5/6] Bluetooth: L2CAP: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Convert L2CAP socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt
- Use sopt->optlen for buffer length (input)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- Add linux/uio.h for copy_to_iter()
The sockopt_t parameter is named sopt rather than opt to avoid
collision with the existing local u32 opt used by L2CAP_LM. The same
naming is reused for the new u32 helper in l2cap_sock_getsockopt(),
with mtu and mval helpers covering the u16 and u8 cases.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/l2cap_sock.c | 61 ++++++++++++++++++++++++++++------------------
1 file changed, 37 insertions(+), 24 deletions(-)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index cf590a67d3641..dede550d60319 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -31,6 +31,7 @@
#include <linux/export.h>
#include <linux/filter.h>
#include <linux/sched/signal.h>
+#include <linux/uio.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -433,7 +434,7 @@ static int l2cap_get_mode(struct l2cap_chan *chan)
}
static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *sopt)
{
struct sock *sk = sock->sk;
struct l2cap_chan *chan = l2cap_pi(sk)->chan;
@@ -445,8 +446,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
BT_DBG("sk %p", sk);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = sopt->optlen;
lock_sock(sk);
@@ -488,7 +488,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
BT_DBG("mode 0x%2.2x", chan->mode);
len = min(len, sizeof(opts));
- if (copy_to_user(optval, (char *) &opts, len))
+ if (copy_to_iter(&opts, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -520,7 +520,8 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
opt |= L2CAP_LM_RELIABLE;
- if (put_user(opt, (u32 __user *) optval))
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -538,7 +539,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
len = min(len, sizeof(cinfo));
- if (copy_to_user(optval, (char *) &cinfo, len))
+ if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -553,25 +554,26 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
}
static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *sopt)
{
struct sock *sk = sock->sk;
struct l2cap_chan *chan = l2cap_pi(sk)->chan;
struct bt_security sec;
struct bt_power pwr;
- u32 phys;
int len, mode, err = 0;
+ u32 opt;
+ u16 mtu;
+ u8 mval;
BT_DBG("sk %p", sk);
if (level == SOL_L2CAP)
- return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
+ return l2cap_sock_getsockopt_old(sock, optname, sopt);
if (level != SOL_BLUETOOTH)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = sopt->optlen;
lock_sock(sk);
@@ -595,7 +597,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
}
len = min_t(unsigned int, len, sizeof(sec));
- if (copy_to_user(optval, (char *) &sec, len))
+ if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -606,15 +608,17 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
- (u32 __user *) optval))
+ opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
case BT_FLUSHABLE:
- if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
- (u32 __user *) optval))
+ opt = test_bit(FLAG_FLUSHABLE, &chan->flags);
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -629,13 +633,15 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
len = min_t(unsigned int, len, sizeof(pwr));
- if (copy_to_user(optval, (char *) &pwr, len))
+ if (copy_to_iter(&pwr, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
case BT_CHANNEL_POLICY:
- if (put_user(chan->chan_policy, (u32 __user *) optval))
+ opt = chan->chan_policy;
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -650,7 +656,9 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(chan->omtu, (u16 __user *) optval))
+ mtu = chan->omtu;
+ if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
+ sizeof(mtu))
err = -EFAULT;
break;
@@ -660,7 +668,9 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(chan->imtu, (u16 __user *) optval))
+ mtu = chan->imtu;
+ if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
+ sizeof(mtu))
err = -EFAULT;
break;
@@ -670,9 +680,10 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- phys = hci_conn_get_phy(chan->conn->hcon);
+ opt = hci_conn_get_phy(chan->conn->hcon);
- if (put_user(phys, (u32 __user *) optval))
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -693,7 +704,9 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(mode, (u8 __user *) optval))
+ mval = mode;
+ if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) !=
+ sizeof(mval))
err = -EFAULT;
break;
@@ -2000,7 +2013,7 @@ static const struct proto_ops l2cap_sock_ops = {
.socketpair = sock_no_socketpair,
.shutdown = l2cap_sock_shutdown,
.setsockopt = l2cap_sock_setsockopt,
- .getsockopt = l2cap_sock_getsockopt
+ .getsockopt_iter = l2cap_sock_getsockopt
};
static const struct net_proto_family l2cap_sock_family_ops = {
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 4/6] Bluetooth: RFCOMM: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Convert RFCOMM socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt
- Use sopt->optlen for buffer length (input)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- Add linux/uio.h for copy_to_iter()
The sockopt_t parameter is named sopt rather than opt to avoid
collision with the existing local u32 opt used by RFCOMM_LM.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/rfcomm/sock.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index be6639cd6f590..9b22e4240ed14 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -28,6 +28,7 @@
#include <linux/export.h>
#include <linux/debugfs.h>
#include <linux/sched/signal.h>
+#include <linux/uio.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -723,7 +724,8 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
return err;
}
-static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
+static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname,
+ sockopt_t *sopt)
{
struct sock *sk = sock->sk;
struct sock *l2cap_sk;
@@ -735,8 +737,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
BT_DBG("sk %p", sk);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = sopt->optlen;
lock_sock(sk);
@@ -765,7 +766,8 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
if (rfcomm_pi(sk)->role_switch)
opt |= RFCOMM_LM_MASTER;
- if (put_user(opt, (u32 __user *) optval))
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -785,7 +787,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
len = min(len, sizeof(cinfo));
- if (copy_to_user(optval, (char *) &cinfo, len))
+ if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -799,23 +801,24 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
return err;
}
-static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname,
+ sockopt_t *sopt)
{
struct sock *sk = sock->sk;
struct bt_security sec;
int err = 0;
size_t len;
+ u32 opt;
BT_DBG("sk %p", sk);
if (level == SOL_RFCOMM)
- return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
+ return rfcomm_sock_getsockopt_old(sock, optname, sopt);
if (level != SOL_BLUETOOTH)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = sopt->optlen;
lock_sock(sk);
@@ -830,7 +833,7 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
sec.key_size = 0;
len = min(len, sizeof(sec));
- if (copy_to_user(optval, (char *) &sec, len))
+ if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -841,8 +844,9 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
break;
}
- if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
- (u32 __user *) optval))
+ opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -1014,7 +1018,7 @@ static const struct proto_ops rfcomm_sock_ops = {
.recvmsg = rfcomm_sock_recvmsg,
.shutdown = rfcomm_sock_shutdown,
.setsockopt = rfcomm_sock_setsockopt,
- .getsockopt = rfcomm_sock_getsockopt,
+ .getsockopt_iter = rfcomm_sock_getsockopt,
.ioctl = rfcomm_sock_ioctl,
.gettstamp = sock_gettstamp,
.poll = bt_sock_poll,
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 3/6] Bluetooth: ISO: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Convert ISO socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- Add linux/uio.h for copy_to_iter()
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/iso.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7cb2864fe8724..0d792d36bb5ac 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -10,6 +10,7 @@
#include <linux/debugfs.h>
#include <linux/seq_file.h>
#include <linux/sched/signal.h>
+#include <linux/uio.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -1842,18 +1843,17 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
}
static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
- int len, err = 0;
struct bt_iso_qos *qos;
+ int len, val, err = 0;
u8 base_len;
u8 *base;
BT_DBG("sk %p", sk);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
lock_sock(sk);
@@ -1864,15 +1864,17 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
- if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
- (u32 __user *)optval))
+ val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+ if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
+ sizeof(val))
err = -EFAULT;
break;
case BT_PKT_STATUS:
- if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
- (int __user *)optval))
+ val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
+ if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
+ sizeof(val))
err = -EFAULT;
break;
@@ -1880,7 +1882,7 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
qos = iso_sock_get_qos(sk);
len = min_t(unsigned int, len, sizeof(*qos));
- if (copy_to_user(optval, qos, len))
+ if (copy_to_iter(qos, len, &opt->iter_out) != len)
err = -EFAULT;
break;
@@ -1896,9 +1898,8 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
}
len = min_t(unsigned int, len, base_len);
- if (copy_to_user(optval, base, len))
- err = -EFAULT;
- if (put_user(len, optlen))
+ opt->optlen = len;
+ if (copy_to_iter(base, len, &opt->iter_out) != len)
err = -EFAULT;
break;
@@ -2660,7 +2661,7 @@ static const struct proto_ops iso_sock_ops = {
.socketpair = sock_no_socketpair,
.shutdown = iso_sock_shutdown,
.setsockopt = iso_sock_setsockopt,
- .getsockopt = iso_sock_getsockopt
+ .getsockopt_iter = iso_sock_getsockopt
};
static const struct net_proto_family iso_sock_family_ops = {
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 2/6] Bluetooth: hci_sock: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
Convert HCI socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt
- Use sopt->optlen for buffer length (input)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- Add linux/uio.h for copy_to_iter()
The sockopt_t parameter is named sopt rather than opt to avoid
collision with the existing local int opt used by HCI_DATA_DIR and
HCI_TIME_STAMP.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/hci_sock.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1823c06ba8940..61fec674a2078 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -27,6 +27,7 @@
#include <linux/export.h>
#include <linux/utsname.h>
#include <linux/sched.h>
+#include <linux/uio.h>
#include <linux/unaligned.h>
#include <net/bluetooth/bluetooth.h>
@@ -2063,7 +2064,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
}
static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *sopt)
{
struct hci_ufilter uf;
struct sock *sk = sock->sk;
@@ -2071,8 +2072,7 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
BT_DBG("sk %p, opt %d", sk, optname);
- if (get_user(len, optlen))
- return -EFAULT;
+ len = sopt->optlen;
lock_sock(sk);
@@ -2088,7 +2088,8 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
else
opt = 0;
- if (put_user(opt, (int __user *)optval))
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -2098,7 +2099,8 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
else
opt = 0;
- if (put_user(opt, (int __user *)optval))
+ if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
+ sizeof(opt))
err = -EFAULT;
break;
@@ -2114,7 +2116,7 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
}
len = min_t(unsigned int, len, sizeof(uf));
- if (copy_to_user(optval, &uf, len))
+ if (copy_to_iter(&uf, len, &sopt->iter_out) != len)
err = -EFAULT;
break;
@@ -2129,16 +2131,16 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
}
static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *sopt)
{
struct sock *sk = sock->sk;
int err = 0;
+ u16 mtu;
BT_DBG("sk %p, opt %d", sk, optname);
if (level == SOL_HCI)
- return hci_sock_getsockopt_old(sock, level, optname, optval,
- optlen);
+ return hci_sock_getsockopt_old(sock, level, optname, sopt);
if (level != SOL_BLUETOOTH)
return -ENOPROTOOPT;
@@ -2148,7 +2150,9 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
switch (optname) {
case BT_SNDMTU:
case BT_RCVMTU:
- if (put_user(hci_pi(sk)->mtu, (u16 __user *)optval))
+ mtu = hci_pi(sk)->mtu;
+ if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
+ sizeof(mtu))
err = -EFAULT;
break;
@@ -2185,7 +2189,7 @@ static const struct proto_ops hci_sock_ops = {
.listen = sock_no_listen,
.shutdown = sock_no_shutdown,
.setsockopt = hci_sock_setsockopt,
- .getsockopt = hci_sock_getsockopt,
+ .getsockopt_iter = hci_sock_getsockopt,
.connect = sock_no_connect,
.socketpair = sock_no_socketpair,
.accept = sock_no_accept,
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 1/6] Bluetooth: hci_sock: write the full optval for getsockopt
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
In-Reply-To: <20260512-getsock_three-v2-0-30b7b22ef14c@debian.org>
In hci_sock_getsockopt_old(), HCI_DATA_DIR and HCI_TIME_STAMP both store
their value into a local int and then call put_user(opt, optval). Because
optval is the function parameter typed char __user *, put_user sizes the
write from sizeof(*optval), so only the low byte of the int is copied to
userspace.
The matching setsockopt path reads sizeof(int) via copy_safe_from_sockptr,
so userspace passes a 4-byte buffer in both directions but previously got
back only one initialized byte on the read side.
Not sending this through 'net' tree given this bug is mostly invisble,
given opt is 0/1, and the last byte is being properly copied.
With this change, the upcoming translation to .getsockopt_iter becomes
mechanical.
FWIW: This behavior appeared in commit 1da177e4c3f4 ("Linux-2.6.12-rc2").
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/bluetooth/hci_sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 0290dea081f62..1823c06ba8940 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -2088,7 +2088,7 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
else
opt = 0;
- if (put_user(opt, optval))
+ if (put_user(opt, (int __user *)optval))
err = -EFAULT;
break;
@@ -2098,7 +2098,7 @@ static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
else
opt = 0;
- if (put_user(opt, optval))
+ if (put_user(opt, (int __user *)optval))
err = -EFAULT;
break;
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v2 0/6] Bluetooth: convert remaining bluetooth socket families to getsockopt_iter
From: Breno Leitao @ 2026-05-12 11:12 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan
Cc: linux-bluetooth, linux-kernel, netdev, linux-kselftest,
Breno Leitao
Continue the conversion to .getsockopt_iter for the Bluetooth socket
families: hci_sock, ISO, RFCOMM, SCO and L2CAP. The first patch is a
small precursor that fixes a long-standing 1-byte put_user write in
hci_sock_getsockopt_old() so the subsequent conversion stays mechanical.
The riskiest change in this series is the SCO BT_CODEC conversion: it
is the only one that drops an open-coded ptr cursor in favour of
relying on iter_out advancing naturally on every copy_to_iter() call.
Every other socket option is a near-mechanical s/copy_to_user/
copy_to_iter/ rewrite, but BT_CODEC walks a variable-length list of
codecs + capabilities and previously tracked its own write offset by
hand. Getting the cursor semantics wrong here would silently truncate
or misalign user-visible codec data.
For more context about the motivation for this change, please check
commit 67fab22a7ad ("net: add getsockopt_iter callback to proto_ops")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Changes in v2:
- rebase the tree on top of bluetooth-next.
- Remove the selftest, which was mixing network and bluetooth together.
- Link to v1: https://patch.msgid.link/20260511-getsock_three-v1-0-1461fa8786ab@debian.org
To: Marcel Holtmann <marcel@holtmann.org>
To: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
Breno Leitao (6):
Bluetooth: hci_sock: write the full optval for getsockopt
Bluetooth: hci_sock: convert to getsockopt_iter
Bluetooth: ISO: convert to getsockopt_iter
Bluetooth: RFCOMM: convert to getsockopt_iter
Bluetooth: L2CAP: convert to getsockopt_iter
Bluetooth: SCO: convert to getsockopt_iter
net/bluetooth/hci_sock.c | 26 +++++++++++--------
net/bluetooth/iso.c | 27 ++++++++++----------
net/bluetooth/l2cap_sock.c | 61 +++++++++++++++++++++++++++------------------
net/bluetooth/rfcomm/sock.c | 30 ++++++++++++----------
net/bluetooth/sco.c | 59 ++++++++++++++++++++++---------------------
5 files changed, 114 insertions(+), 89 deletions(-)
---
base-commit: c2f0079e8c42fd6814c8d6b1491e3ce0a0e3b3fa
change-id: 20260511-getsock_three-d0d7f1b2629e
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply
* RE: [v3] Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
From: bluez.test.bot @ 2026-05-12 10:38 UTC (permalink / raw)
To: linux-bluetooth, ravindra
In-Reply-To: <20260512083444.1214935-1-ravindra@intel.com>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1093368
---Test result---
Test Summary:
CheckPatch PASS 0.64 seconds
GitLint PASS 0.27 seconds
SubjectPrefix PASS 0.10 seconds
BuildKernel PASS 24.75 seconds
CheckAllWarning PASS 27.64 seconds
CheckSparse PASS 26.15 seconds
BuildKernel32 PASS 24.57 seconds
TestRunnerSetup PASS 521.93 seconds
IncrementalBuild PASS 23.69 seconds
https://github.com/bluez/bluetooth-next/pull/177
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [RFC BlueZ] media: Fix possible crash on exit/adapter removal
From: Bastien Nocera @ 2026-05-12 10:14 UTC (permalink / raw)
To: linux-bluetooth
Nothing protects media_endpoint_remove() from being called multiple
times for the same structure. Before a g_free() call is made on
endpoint->capabilities, there are NULL checks, and NULL setting,
for every variable that might get modified, so a second call to the same
function, even though it's still using-after-free, is only
reading-after-free, and might crash at the first attempt at modifying
that freed memory.
The reason why this function might be called multiple times is because
in some circumstances, another signal might be received that the
endpoint is getting removed while we're already in the process of
removing that endpoint.
For example, release_endpoint() (which should appear in between
path_free() and media_endpoint_remove() in the below backtrace, as
that's the function called at profiles/audio/media.c:3651), will send a
D-Bus message which it then waits for the answer to, meaning that other
D-Bus message could be received while we're waiting for the answer, and
then destroying the endpoint.
#11 media_endpoint_destroy at profiles/audio/media.c:231
#12 media_endpoint_remove at profiles/audio/media.c:314
#13 path_free at profiles/audio/media.c:3651
#14 remove_interface at gdbus/object.c:742
#15 g_dbus_unregister_interface at gdbus/object.c:1499
#16 g_slist_foreach at ../glib/gslist.c:837
#17 unload_drivers at src/adapter.c:5932
#18 adapter_remove at src/adapter.c:7088
#19 adapter_unregister at src/adapter.c:9504
#20 index_removed at src/adapter.c:10693
#21 queue_foreach at src/shared/queue.c:207
#23 process_notify at src/shared/mgmt.c:349
#24 can_read_data at src/shared/mgmt.c:409
#25 watch_callback at src/shared/io-glib.c:173
#27 g_main_context_dispatch_unlocked at ../glib/gmain.c:4451
#28 g_main_context_iterate_unlocked at ../glib/gmain.c:4516
#30 mainloop_run at src/shared/mainloop-glib.c:65
#31 mainloop_run_with_signal at src/shared/mainloop-notify.c:196
in profiles/audio/media.c:
231 g_free(endpoint->capabilities);
See https://bugzilla.redhat.com/show_bug.cgi?id=2467980
---
profiles/audio/media.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index cdaafb04e38c..ad31872c6431 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -611,6 +611,7 @@ static gboolean set_configuration(struct media_endpoint *endpoint,
static void release_endpoint(struct media_endpoint *endpoint)
{
DBusMessage *msg;
+ struct media_adapter *adapter = endpoint->adapter;
DBG("sender=%s path=%s", endpoint->sender, endpoint->path);
@@ -631,7 +632,9 @@ static void release_endpoint(struct media_endpoint *endpoint)
g_dbus_send_message(btd_get_dbus_connection(), msg);
done:
- media_endpoint_remove(endpoint);
+ /* Make sure endpoint didn't already get removed */
+ if (g_slist_find(adapter->endpoints, endpoint))
+ media_endpoint_remove(endpoint);
}
static const char *get_name(struct a2dp_sep *sep, void *user_data)
--
2.54.0
^ permalink raw reply related
* RE: [BlueZ] pbap: Fix not checking Database Identifier length
From: bluez.test.bot @ 2026-05-12 10:07 UTC (permalink / raw)
To: linux-bluetooth, frederic.danis
In-Reply-To: <20260512083750.178053-1-frederic.danis@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 825 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1093372
---Test result---
Test Summary:
CheckPatch PASS 0.48 seconds
GitLint PASS 0.35 seconds
BuildEll PASS 20.05 seconds
BluezMake PASS 605.42 seconds
CheckSmatch PASS 327.55 seconds
bluezmakeextell PASS 166.87 seconds
IncrementalBuild PASS 618.83 seconds
ScanBuild PASS 917.76 seconds
https://github.com/bluez/bluez/pull/2120
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [PATCH v1] Bluetooth: btintel_pcie: Reset controller before configuring MSI-X
From: K, Kiran @ 2026-05-12 9:50 UTC (permalink / raw)
To: Paul Menzel
Cc: linux-bluetooth@vger.kernel.org, Srivatsa, Ravishankar,
Tumkur Narayan, Chethan, Aluvala Sai Teja
In-Reply-To: <58a3bb31-a730-49b1-9c80-930f4099b0e8@molgen.mpg.de>
Hi Paul,
Thanks for the comments.
>Subject: Re: [PATCH v1] Bluetooth: btintel_pcie: Reset controller before
>configuring MSI-X
>
>Dear Kiran,
>
>
>Thank you for your patch.
>
>Am 11.05.26 um 15:27 schrieb Kiran K:
>> From: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
>>
>> Perform the shared hardware reset in btintel_pcie_probe() before
>> configuring MSI-X so the controller starts from a known clean state.
>
>Did you run into problems with the current ordering?
Yes, we found hardware initialization issue due to which _probe() was failing and the issue was seen only in simics (virtual environment). This happens if hardware is not reset to boot rom mode before initializing.
>
>> While here, move btintel_pcie_config_msix() out of
>> btintel_pcie_config_pcie() and into the probe sequence, and propagate
>> errors from btintel_pcie_reset_bt() so probe fails cleanly if the
>> shared HW reset does not complete.
>
>“While here” also sounds to me to split the commit into two. But your call.
I will update the commit message in v2 version of the patch.
>
>Please add a paragraph how to test it. (Maybe what log messages to look out
>for.) Is there a way to force `btintel_pcie_reset_bt()` to fail?
>
>> Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
>> Signed-off-by: Kiran K <kiran.k@intel.com>
>> ---
>> drivers/bluetooth/btintel_pcie.c | 11 ++++++++---
>> 1 file changed, 8 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/bluetooth/btintel_pcie.c
>> b/drivers/bluetooth/btintel_pcie.c
>> index fda474406003..6ff08de9ec78 100644
>> --- a/drivers/bluetooth/btintel_pcie.c
>> +++ b/drivers/bluetooth/btintel_pcie.c
>> @@ -1646,9 +1646,6 @@ static int btintel_pcie_config_pcie(struct pci_dev
>*pdev,
>> if (err)
>> return err;
>>
>> - /* Configure MSI-X with causes list */
>> - btintel_pcie_config_msix(data);
>> -
>> return 0;
>> }
>>
>> @@ -2659,6 +2656,14 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>> if (err)
>> goto exit_error;
>>
>> + err = btintel_pcie_reset_bt(data);
>> + if (err) {
>> + dev_err(&pdev->dev, "Bluetooth shared HW reset failed
>(%d)\n",
>> +err);
>
>What is “shared HW reset”?
Shared HW reset refers to initializing hardware to boot rom state.
>
>> + goto exit_error;
>> + }
>> +
>> + /* Configure MSI-X with causes list */
>> + btintel_pcie_config_msix(data);
>> pci_set_drvdata(pdev, data);
>>
>> err = btintel_pcie_alloc(data);
>
>
>Kind regards,
>
>Paul
Thanks,
Kiran
^ permalink raw reply
* Re: [PATCH v1] Bluetooth: btusb: Add support for Intel Lizard Peak2 (0x8087:0x0040)
From: Ravindra @ 2026-05-12 9:30 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
Cc: Srivatsa, Ravishankar, K, Kiran, Tumkur Narayan, Chethan,
Paul Menzel
In-Reply-To: <33bfcf77-2709-4b5d-a932-ed2987c6410f@molgen.mpg.de>
________________________________________
From: Paul Menzel <pmenzel@molgen.mpg.de>
Sent: Tuesday, May 12, 2026 11:54 AM
To: Ravindra <ravindra@intel.com>
Cc: linux-bluetooth@vger.kernel.org <linux-bluetooth@vger.kernel.org>; Srivatsa, Ravishankar <ravishankar.srivatsa@intel.com>; K, Kiran <kiran.k@intel.com>; Tumkur Narayan, Chethan <chethan.tumkur.narayan@intel.com>
Subject: Re: [PATCH v1] Bluetooth: btusb: Add support for Intel Lizard Peak2 (0x8087:0x0040)
Dear Ravindra,
Thank you for your patch.
(Is the spelling for Lizard Peak2 really without a space before the 2?)
Yes, that is not correct. According to the hardware specification and the firmware strings, "Lizard Peak 2" is the correct one.
Am 12.05.26 um 08:20 schrieb Ravindra:
> Device from /sys/kernel/debug/usb/devices:
>
> T: Bus=09 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
> D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
> P: Vendor=8087 ProdID=0040 Rev= 0.00
> C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
> I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
> E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
>
> Signed-off-by: Ravindra <ravindra@intel.com>
> ---
> drivers/bluetooth/btusb.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 572091e601f9..3f012c2a014a 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -484,6 +484,7 @@ static const struct usb_device_id quirks_table[] = {
> { USB_DEVICE(0x8087, 0x0037), .driver_info = BTUSB_INTEL_COMBINED },
> { USB_DEVICE(0x8087, 0x0038), .driver_info = BTUSB_INTEL_COMBINED },
> { USB_DEVICE(0x8087, 0x0039), .driver_info = BTUSB_INTEL_COMBINED },
> + { USB_DEVICE(0x8087, 0x0040), .driver_info = BTUSB_INTEL_COMBINED }, /* Lizard Peak2 */
> { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
> { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
> BTUSB_INTEL_NO_WBS_SUPPORT |
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Kind regards,
Paul
^ permalink raw reply
* [bluez/bluez] 88b4a6: pbap: Fix not checking Database Identifier length
From: fdanis-oss @ 2026-05-12 9:22 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1093372
Home: https://github.com/bluez/bluez
Commit: 88b4a67b600e6fe2427c69629af229d292ae6076
https://github.com/bluez/bluez/commit/88b4a67b600e6fe2427c69629af229d292ae6076
Author: Frédéric Danis <frederic.danis@collabora.com>
Date: 2026-05-12 (Tue, 12 May 2026)
Changed paths:
M obexd/client/pbap.c
Log Message:
-----------
pbap: Fix not checking Database Identifier length
Database Identifier is supposed to be 16 bytes values.
A paired Bluetooth device acting as a PBAP server can overflow the
heap in obexd by up to 239 bytes into adjacent allocations by returning
a DATABASEID_TAG application parameter with an oversized length.
With both length and content fully attacker-controlled, this enables
standard glibc heap exploitation primitives (tcache/fastbin poisoning)
leading to remote code execution in the obexd process.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox