* Re: [PATCH] Bluetooth: btintel: Fix insufficient skb length check in btintel_print_fseq_info()
From: Luiz Augusto von Dentz @ 2026-05-14 17:35 UTC (permalink / raw)
To: Quan Sun; +Cc: linux-bluetooth, kiran.k, marcel
In-Reply-To: <20260514164913.3123671-1-2022090917019@std.uestc.edu.cn>
Hi,
On Thu, May 14, 2026 at 12:49 PM Quan Sun
<2022090917019@std.uestc.edu.cn> wrote:
>
> The length check at the top of btintel_print_fseq_info() verifies
> that the skb has at least 66 bytes (sizeof(u32) * 16 + 2), but the
> function actually consumes 74 bytes:
>
> 2 calls to skb_pull_data(skb, 1) = 2 bytes
> 18 calls to skb_pull_data(skb, 4) = 72 bytes
>
> When the firmware returns a packet of exactly 66 bytes, the last two
> skb_pull_data(skb, 4) calls return NULL, which is then passed directly
> to get_unaligned_le32(), resulting in a NULL pointer dereference.
>
> Fix the length check to account for all 74 bytes actually consumed:
> sizeof(u32) * 16 + 2 -> sizeof(u32) * 18 + 2
>
> Fixes: a7ba218a44aa ("Bluetooth: btintel: Print Firmware Sequencer information")
> Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>
> ---
> drivers/bluetooth/btintel.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
> index dcaaa4ca02b99..114a8beeab92d 100644
> --- a/drivers/bluetooth/btintel.c
> +++ b/drivers/bluetooth/btintel.c
> @@ -3356,7 +3356,7 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
> return;
> }
>
> - if (skb->len < (sizeof(u32) * 16 + 2)) {
> + if (skb->len < (sizeof(u32) * 18 + 2)) {
Or we stop doing this manually and the check the return of
skb_pull_data, that way we garantee we don't use its returns without
checking if it return NULL, which is the whole point in using
skb_pull_data otherwise we had just used skb_pull.
> bt_dev_dbg(hdev, "Malformed packet of length %u received",
> skb->len);
> kfree_skb(skb);
> --
> 2.43.0
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* [GIT PULL] bluetooth 2026-05-14
From: Luiz Augusto von Dentz @ 2026-05-14 17:23 UTC (permalink / raw)
To: davem, kuba; +Cc: linux-bluetooth, netdev
The following changes since commit c78bdba7b9666020c0832150a4fc4c0aebc7c6ac:
net: phy: DP83TC811: add reading of abilities (2026-05-14 15:17:12 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-14
for you to fetch changes up to 375ba7484132662a4a8c7547d088fb6275c00282:
Bluetooth: hci_qca: Convert timeout from jiffies to ms (2026-05-14 09:58:08 -0400)
----------------------------------------------------------------
bluetooth pull request for net:
- af_bluetooth: serialize accept_q access
- L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
- btmtk: accept too short WMT FUNC_CTRL events
- hci_qca: Convert timeout from jiffies to ms
----------------------------------------------------------------
Jiexun Wang (1):
Bluetooth: serialize accept_q access
Michael Bommarito (1):
Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
Pauli Virtanen (1):
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
Shuai Zhang (1):
Bluetooth: hci_qca: Convert timeout from jiffies to ms
drivers/bluetooth/btmtk.c | 4 +-
drivers/bluetooth/hci_qca.c | 33 +++++++--------
include/net/bluetooth/bluetooth.h | 1 +
net/bluetooth/af_bluetooth.c | 87 +++++++++++++++++++++++++++++----------
net/bluetooth/l2cap_core.c | 2 +-
5 files changed, 85 insertions(+), 42 deletions(-)
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-05-14 17:19 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1081191
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* RE: [v2] Bluetooth: hci_uart: fix UAF in hci_uart_tty_close()
From: bluez.test.bot @ 2026-05-14 17:00 UTC (permalink / raw)
To: linux-bluetooth, w15303746062
In-Reply-To: <20260514151722.382161-1-w15303746062@163.com>
[-- Attachment #1: Type: text/plain, Size: 2645 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094870
---Test result---
Test Summary:
CheckPatch FAIL 0.64 seconds
GitLint FAIL 0.27 seconds
SubjectPrefix PASS 0.10 seconds
BuildKernel PASS 26.17 seconds
CheckAllWarning PASS 28.47 seconds
CheckSparse PASS 27.00 seconds
BuildKernel32 PASS 24.99 seconds
TestRunnerSetup PASS 556.38 seconds
IncrementalBuild PASS 24.51 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v2] Bluetooth: hci_uart: fix UAF in hci_uart_tty_close()
WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#85:
ODEBUG: free active (active state 0) object: ffff88804024e870 object type: work_struct hint: hci_uart_write_work+0x0/0x940
total: 0 errors, 1 warnings, 21 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14573255.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2] Bluetooth: hci_uart: fix UAF in hci_uart_tty_close()
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
16: B1 Line exceeds max length (124>80): " ODEBUG: free active (active state 0) object: ffff88804024e870 object type: work_struct hint: hci_uart_write_work+0x0/0x940"
17: B1 Line exceeds max length (86>80): " WARNING: CPU: 0 PID: 338273 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0"
55: B1 Line exceeds max length (104>80): "- Added explanation for the absence of a standalone reproducer (highly timing-dependent race condition)."
https://github.com/bluez/bluetooth-next/pull/190
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: btintel: Fix insufficient skb length check in btintel_print_fseq_info()
From: Quan Sun @ 2026-05-14 16:49 UTC (permalink / raw)
To: linux-bluetooth, kiran.k, luiz.dentz, marcel; +Cc: Quan Sun
The length check at the top of btintel_print_fseq_info() verifies
that the skb has at least 66 bytes (sizeof(u32) * 16 + 2), but the
function actually consumes 74 bytes:
2 calls to skb_pull_data(skb, 1) = 2 bytes
18 calls to skb_pull_data(skb, 4) = 72 bytes
When the firmware returns a packet of exactly 66 bytes, the last two
skb_pull_data(skb, 4) calls return NULL, which is then passed directly
to get_unaligned_le32(), resulting in a NULL pointer dereference.
Fix the length check to account for all 74 bytes actually consumed:
sizeof(u32) * 16 + 2 -> sizeof(u32) * 18 + 2
Fixes: a7ba218a44aa ("Bluetooth: btintel: Print Firmware Sequencer information")
Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>
---
drivers/bluetooth/btintel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index dcaaa4ca02b99..114a8beeab92d 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3356,7 +3356,7 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
return;
}
- if (skb->len < (sizeof(u32) * 16 + 2)) {
+ if (skb->len < (sizeof(u32) * 18 + 2)) {
bt_dev_dbg(hdev, "Malformed packet of length %u received",
skb->len);
kfree_skb(skb);
--
2.43.0
^ permalink raw reply related
* [Bug 221511] MT7925 7.1 rc does not work, but it works in kernel 7.0
From: bugzilla-daemon @ 2026-05-14 16:21 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-221511-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=221511
--- Comment #3 from erpumper@gmail.com ---
none
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* RE: [v1] Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
From: bluez.test.bot @ 2026-05-14 16:02 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260514134224.1396820-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2153 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094806
---Test result---
Test Summary:
CheckPatch PASS 0.54 seconds
GitLint FAIL 0.23 seconds
SubjectPrefix PASS 0.06 seconds
BuildKernel PASS 27.55 seconds
CheckAllWarning PASS 30.63 seconds
CheckSparse PASS 28.53 seconds
BuildKernel32 PASS 26.95 seconds
TestRunnerSetup PASS 583.25 seconds
TestRunner_l2cap-tester PASS 379.22 seconds
TestRunner_iso-tester PASS 597.48 seconds
TestRunner_bnep-tester PASS 18.76 seconds
TestRunner_mgmt-tester PASS 2022.56 seconds
TestRunner_rfcomm-tester PASS 63.79 seconds
TestRunner_sco-tester PASS 141.90 seconds
TestRunner_ioctl-tester PASS 133.51 seconds
TestRunner_mesh-tester PASS 59.94 seconds
TestRunner_smp-tester PASS 18.37 seconds
TestRunner_userchan-tester PASS 19.42 seconds
TestRunner_6lowpan-tester PASS 51.16 seconds
IncrementalBuild PASS 25.05 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v1] Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (90>80): "[v1] Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE"
https://github.com/bluez/bluetooth-next/pull/189
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH v2] Bluetooth: hci_uart: fix UAF in hci_uart_tty_close()
From: w15303746062 @ 2026-05-14 15:17 UTC (permalink / raw)
To: pmenzel, marcel, luiz.dentz, linux-bluetooth
Cc: linux-serial, linux-kernel, Mingyu Wang
In-Reply-To: <505b56bd-e5fd-4feb-a6e3-1d8269609277@molgen.mpg.de>
From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
A Use-After-Free (UAF) vulnerability and a subsequent kernel panic were
observed in hci_uart_write_work() due to a race condition between the
initialization of the HCI UART line discipline and concurrent TTY hangup.
This issue was triggered by our custom device emulation and fuzzing
framework (DevGen) on the v6.18 kernel. Due to the highly timing-dependent
nature of this race condition (requiring a precise interleaving of
TIOCVHANGUP and protocol setup), Syzkaller failed to extract a reliable
standalone C reproducer (reproducer is too unreliable: 0.00).
The crash trace is as follows:
ODEBUG: free active (active state 0) object: ffff88804024e870 object type: work_struct hint: hci_uart_write_work+0x0/0x940
WARNING: CPU: 0 PID: 338273 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0
...
Call Trace:
<TASK>
debug_check_no_obj_freed+0x3ec/0x520
kfree+0x3f0/0x6c0
hci_uart_tty_close+0x127/0x2a0
tty_ldisc_close+0x113/0x1a0
tty_ldisc_kill+0x8e/0x150
tty_ldisc_hangup+0x3c1/0x730
__tty_hangup.part.0+0x3fd/0x8a0
tty_ioctl+0x120f/0x1690
__x64_sys_ioctl+0x18f/0x210
do_syscall_64+0xcb/0xfa0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
The issue arises because the workqueues (init_ready and write_work) are
only cancelled if the HCI_UART_PROTO_READY flag is set. However, during
the protocol initialization phase (HCI_UART_PROTO_INIT), the underlying
protocol may schedule work. If a hangup occurs before the setup completes
and the READY flag is set, hci_uart_tty_close() skips the cancel_work_sync()
calls and proceeds to free the `hu` struct. When the delayed workqueue
executes, it blindly dereferences the freed `hu` struct.
Fix this by moving the cancel_work_sync() calls outside the
HCI_UART_PROTO_READY check, ensuring that any pending works are
unconditionally cancelled before the hci_uart structure is freed.
Note that hu->init_ready and hu->write_work are initialized in
hci_uart_tty_open(), so it is always safe to call cancel_work_sync()
on them in hci_uart_tty_close(), even if the protocol was never
fully attached.
Fixes: 3b799254cf6f ("Bluetooth: hci_uart: Cancel init work before unregistering")
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
---
Changes in v2:
- Added KASAN/ODEBUG crash trace.
- Added explanation for the absence of a standalone reproducer (highly timing-dependent race condition).
- Added Fixes tag pointing to commit 3b799254cf6f.
drivers/bluetooth/hci_ldisc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 275ea865bc29..566e1c525ee2 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -544,14 +544,18 @@ static void hci_uart_tty_close(struct tty_struct *tty)
if (hdev)
hci_uart_close(hdev);
+ /*
+ * Always cancel workqueues unconditionally before freeing the hu
+ * struct, as they might be active during the PROTO_INIT phase.
+ */
+ cancel_work_sync(&hu->init_ready);
+ cancel_work_sync(&hu->write_work);
+
if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) {
percpu_down_write(&hu->proto_lock);
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
percpu_up_write(&hu->proto_lock);
- cancel_work_sync(&hu->init_ready);
- cancel_work_sync(&hu->write_work);
-
if (hdev) {
if (test_bit(HCI_UART_REGISTERED, &hu->flags))
hci_unregister_dev(hdev);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] Bluetooth: hci_core: Don't queue tx_work while draining workqueue
From: Heitor Alves de Siqueira @ 2026-05-14 14:53 UTC (permalink / raw)
To: Hillf Danton
Cc: Marcel Holtmann, Luiz Augusto von Dentz, Gustavo Padovan,
linux-bluetooth, linux-kernel, kernel-dev, syzkaller-bugs,
syzbot+97721dd81f792e838ba0
In-Reply-To: <20260514020446.639-1-hdanton@sina.com>
On Wed May 13, 2026 at 11:04 PM -03, Hillf Danton wrote:
> On Wed, 13 May 2026 15:55:23 -0300 Heitor Alves de Siqueira wrote:
>> Syzbot reported a warning when L2CAP calls queue_work() on the hdev
>> workqueue while it's being drained. This can happen during device reset or
>> close paths for hci_send_acl(), hci_send_sco() and hci_send_iso().
>>
>> The workqueue is drained in hci_dev_do_reset() and in hci_dev_close_sync():
>> - hci_dev_close_sync() clears the HCI_UP bit before draining
>> - hci_dev_do_reset() sets HCI_CMD_DRAIN_WORKQUEUE before draining
>>
>> Add these checks before queuing tx_work, and free the SKB if it's not
>> queued for transmission.
>>
>> Fixes: 3eff45eaf817 ("Bluetooth: convert tx_task to workqueue")
>> Reported-by: syzbot+97721dd81f792e838ba0@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=97721dd81f792e838ba0
>> Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
>> ---
>> net/bluetooth/hci_core.c | 18 ++++++++++++++++++
>> 1 file changed, 18 insertions(+)
>>
>> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
>> index c46c1236ebfa..5d5f8ad7d1a8 100644
>> --- a/net/bluetooth/hci_core.c
>> +++ b/net/bluetooth/hci_core.c
>> @@ -3278,6 +3278,12 @@ void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
>>
>> BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
>>
>> + if (!test_bit(HCI_UP, &hdev->flags) ||
>> + hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) {
>> + kfree_skb(skb);
>> + return;
>> + }
>> +
>> hci_queue_acl(chan, &chan->data_q, skb, flags);
>>
>> queue_work(hdev->workqueue, &hdev->tx_work);
>>
> What you add is not enough, go and see how HCI_CMD_DRAIN_WORKQUEUE is
> checked in hci_cmd_work(), and in hci_dev_do_reset() for why.
I see, I missed the RCU guards for the device flags. Sorry about that,
I'll add them to v2.
Thanks for the catch!
Best,
Heitor
^ permalink raw reply
* [PATCH v1] Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
From: Luiz Augusto von Dentz @ 2026-05-14 13:42 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This fixes not setting the bit for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
when extended features bit is set otherwise the controller may not
generate HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE causing
hci_le_read_all_remote_features_sync to timeout waiting for it.
Also remove dead code.
Fixes: a106e50be74b ("Bluetooth: HCI: Add support for LL Extended Feature Set")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/hci_sync.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index fd3aacdea512..aff8562a8690 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4438,6 +4438,9 @@ static int hci_le_set_event_mask_sync(struct hci_dev *hdev)
events[4] |= 0x02; /* LE BIG Info Advertising Report */
}
+ if (ll_ext_feature_capable(hdev))
+ events[5] |= BIT(2);
+
if (le_cs_capable(hdev)) {
/* Channel Sounding events */
events[5] |= 0x08; /* LE CS Read Remote Supported Cap Complete event */
@@ -7413,9 +7416,6 @@ static int hci_le_read_all_remote_features_sync(struct hci_dev *hdev,
sizeof(cp), &cp,
HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE,
HCI_CMD_TIMEOUT, NULL);
-
- return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ALL_REMOTE_FEATURES,
- sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
static int hci_le_read_remote_features_sync(struct hci_dev *hdev, void *data)
--
2.53.0
^ permalink raw reply related
* Re: MT7922 does not work in 7.1-rc3, works ok in 7.0
From: Taneli Vähäkangas @ 2026-05-14 12:43 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <3da9180c46e0b3651a3ee4d552bb5cf5f8b70186.camel@iki.fi>
Ohh, ok, thanks! Confirmed working, hopefully it gets merged soon.
Cheers,
Taneli
On 14/05/2026 14:31, Pauli Virtanen wrote:
> Hi,
>
> to, 2026-05-14 kello 12:57 +0300, Taneli Vähäkangas kirjoitti:
>> Hey, this might be also a mishap on my side, not yet familiar enough
>> with pacman to say with certainty I didn't mess up something (like
>> firmware loading), but here goes anyway.
>>
>> Bluetooth is provided by:
>> Bus 001 Device 003: ID 0e8d:0616 MediaTek Inc. Wireless_Device
>> I believe. This is a gmktec nucbox k8 plus by dmi information.
>>
>> With distribution's 7.0 kernel bluetooth shows up fine in Gnome and I
>> can connect my headphones and get audio. Using "linux-git" package,
>> which built 7.1-rc3 (+ some commits on top in torvalds tree). Booting to
>> it, bluetooth can't be enabled in Gnome, everything stays grayed out and
>> no devices are shown. (I tried 7.1-rc1 earlier, which also didn't work,
>> but I didn't take any notes back then.)
>>
>> The difference in dmesg is that on 7.0:
>> [ 6.152649] Bluetooth: hci0: Device setup in 173263 usecs
>> [ 6.152661] Bluetooth: hci0: HCI Enhanced Setup Synchronous
>> Connection command is advertised, but not supported.
>> [ 6.216582] Bluetooth: hci0: AOSP extensions version v1.00
>> [ 6.216593] Bluetooth: hci0: AOSP quality report is supported
>> 8<-- 8<--
>>
>> And on 7.1-rc3:
>> [ 6.270455] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
>> [ 6.270466] Bluetooth: hci0: HCI Enhanced Setup Synchronous
>> Connection command is advertised, but not supported.
>> 8<-- 8<--
>
> This has fix pending
> https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=162b1adeb057d28ad84fd8a03f3c50cf08db5c62
>
>>
>> There are some changes in btmtk.c between these versions, but can't see
>> on glance anything wrong with them, only adding support for MT6639.
>>
>> I'm not on the list, please Cc: if I can provide more info.
>>
>> Cheers,
>>
>> Taneli
>
^ permalink raw reply
* Re: MT7922 does not work in 7.1-rc3, works ok in 7.0
From: Luiz Augusto von Dentz @ 2026-05-14 12:34 UTC (permalink / raw)
To: Pauli Virtanen; +Cc: Taneli Vähäkangas, linux-bluetooth
In-Reply-To: <3da9180c46e0b3651a3ee4d552bb5cf5f8b70186.camel@iki.fi>
Hi Pauli, Taneli,
On Thu, May 14, 2026 at 7:32 AM Pauli Virtanen <pav@iki.fi> wrote:
>
> Hi,
>
> to, 2026-05-14 kello 12:57 +0300, Taneli Vähäkangas kirjoitti:
> > Hey, this might be also a mishap on my side, not yet familiar enough
> > with pacman to say with certainty I didn't mess up something (like
> > firmware loading), but here goes anyway.
> >
> > Bluetooth is provided by:
> > Bus 001 Device 003: ID 0e8d:0616 MediaTek Inc. Wireless_Device
> > I believe. This is a gmktec nucbox k8 plus by dmi information.
> >
> > With distribution's 7.0 kernel bluetooth shows up fine in Gnome and I
> > can connect my headphones and get audio. Using "linux-git" package,
> > which built 7.1-rc3 (+ some commits on top in torvalds tree). Booting to
> > it, bluetooth can't be enabled in Gnome, everything stays grayed out and
> > no devices are shown. (I tried 7.1-rc1 earlier, which also didn't work,
> > but I didn't take any notes back then.)
> >
> > The difference in dmesg is that on 7.0:
> > [ 6.152649] Bluetooth: hci0: Device setup in 173263 usecs
> > [ 6.152661] Bluetooth: hci0: HCI Enhanced Setup Synchronous
> > Connection command is advertised, but not supported.
> > [ 6.216582] Bluetooth: hci0: AOSP extensions version v1.00
> > [ 6.216593] Bluetooth: hci0: AOSP quality report is supported
> > 8<-- 8<--
> >
> > And on 7.1-rc3:
> > [ 6.270455] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
> > [ 6.270466] Bluetooth: hci0: HCI Enhanced Setup Synchronous
> > Connection command is advertised, but not supported.
> > 8<-- 8<--
>
> This has fix pending
> https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=162b1adeb057d28ad84fd8a03f3c50cf08db5c62
Will send the PR today.
> >
> > There are some changes in btmtk.c between these versions, but can't see
> > on glance anything wrong with them, only adding support for MT6639.
> >
> > I'm not on the list, please Cc: if I can provide more info.
> >
> > Cheers,
> >
> > Taneli
>
> --
> Pauli Virtanen
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* RE: [v2] Bluetooth: btnxpuart: Fix use-after-free in probe error path
From: bluez.test.bot @ 2026-05-14 12:29 UTC (permalink / raw)
To: linux-bluetooth, winter91
In-Reply-To: <tencent_4A1D33225C74DB33EFAE8A0B6E884567DD09@qq.com>
[-- Attachment #1: Type: text/plain, Size: 1534 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094755
---Test result---
Test Summary:
CheckPatch PASS 0.78 seconds
GitLint FAIL 0.32 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel PASS 26.41 seconds
CheckAllWarning PASS 28.81 seconds
CheckSparse PASS 27.58 seconds
BuildKernel32 PASS 25.67 seconds
TestRunnerSetup PASS 566.44 seconds
IncrementalBuild PASS 24.58 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2] Bluetooth: btnxpuart: Fix use-after-free in probe error path
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
23: B1 Line exceeds max length (96>80): "v1: https://lore.kernel.org/linux-bluetooth/tencent_05373BA21CEEB5195F2ECCED0C77D0C57108@qq.com/"
https://github.com/bluez/bluetooth-next/pull/188
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH RESEND v4 1/1] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
From: Siwei Zhang @ 2026-05-14 12:23 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: Marcel Holtmann, linux-bluetooth
In-Reply-To: <CABBYNZL3UVcogeJGiOzEcyGi3TCGf_pCCz+Vd32K3Li0GmPVwQ@mail.gmail.com>
Hi Luiz,
On Mon, May 11, 2026, at 3:17 PM, Luiz Augusto von Dentz wrote:
> Hi,
>
> On Mon, May 11, 2026 at 1:09 PM Siwei Zhang <oss@fourdim.xyz> wrote:
>>
>> l2cap_sock_new_connection_cb() accesses l2cap_pi(sk)->chan after
>> release_sock(parent). Once the parent lock is released, the child
>> socket sk can be freed by another task.
>>
>> Save the channel pointer into a local variable while the parent lock
>> is still held to prevent this.
>>
>> Fixes: 8ffb929098a5 ("Bluetooth: Remove parent socket usage from l2cap_core.c")
>> Cc: stable@kernel.org
>> Assisted-by: Claude:claude-opus-4-7
>> Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
>> ---
>> net/bluetooth/6lowpan.c | 5 +++++
>> net/bluetooth/l2cap_core.c | 12 ++++++++++++
>> net/bluetooth/l2cap_sock.c | 13 ++++++++++++-
>> net/bluetooth/smp.c | 5 +++++
>> 4 files changed, 34 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
>> index 23a229ab6a33..71c1c04b61e5 100644
>> --- a/net/bluetooth/6lowpan.c
>> +++ b/net/bluetooth/6lowpan.c
>> @@ -755,6 +755,11 @@ static inline struct l2cap_chan *chan_new_conn_cb(struct l2cap_chan *pchan)
>>
>> BT_DBG("chan %p pchan %p", chan, pchan);
>>
>> + /* Match the put that the caller of ops->new_connection() performs
>> + * once it is done with the returned channel pointer.
>> + */
>> + l2cap_chan_hold(chan);
>> +
>> return chan;
>> }
>>
>> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
>> index 7701528f1167..0f6c3c651207 100644
>> --- a/net/bluetooth/l2cap_core.c
>> +++ b/net/bluetooth/l2cap_core.c
>> @@ -4071,6 +4071,9 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
>>
>> __l2cap_chan_add(conn, chan);
>>
>> + /* Drop the ops->new_connection() ref; conn list now pins chan. */
>> + l2cap_chan_put(chan);
>> +
>> dcid = chan->scid;
>>
>> __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
>> @@ -4970,6 +4973,9 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
>>
>> __l2cap_chan_add(conn, chan);
>>
>> + /* Drop the ops->new_connection() ref; conn list now pins chan. */
>> + l2cap_chan_put(chan);
>> +
>> l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
>>
>> dcid = chan->scid;
>> @@ -5194,6 +5200,9 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>>
>> __l2cap_chan_add(conn, chan);
>>
>> + /* Drop the ops->new_connection() ref; conn list now pins chan. */
>> + l2cap_chan_put(chan);
>> +
>> l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
>>
>> /* Init response */
>> @@ -7407,6 +7416,9 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
>> chan->dst_type = dst_type;
>>
>> __l2cap_chan_add(conn, chan);
>> +
>> + /* Drop the ops->new_connection() ref; conn list now pins chan. */
>> + l2cap_chan_put(chan);
>> }
>>
>> l2cap_chan_unlock(pchan);
>> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
>> index cf590a67d364..295c79cf5cf3 100644
>> --- a/net/bluetooth/l2cap_sock.c
>> +++ b/net/bluetooth/l2cap_sock.c
>> @@ -1497,6 +1497,7 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
>> static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
>> {
>> struct sock *sk, *parent = chan->data;
>> + struct l2cap_chan *child_chan;
>>
>> if (!parent)
>> return NULL;
>> @@ -1523,9 +1524,19 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
>>
>> bt_accept_enqueue(parent, sk, false);
>>
>> + child_chan = l2cap_pi(sk)->chan;
>> +
>> + /* Pin the channel for the caller. Once release_sock(parent) returns,
>> + * userspace can accept(2) and immediately close(2) the child socket,
>> + * which would drop the socket's references on the channel and free
>> + * it before the caller (e.g. l2cap_connect_req()) is done using the
>> + * returned pointer. The matching put is the caller's responsibility.
>> + */
>> + l2cap_chan_hold(child_chan);
>
> The entire problem might be solvable by not removing `list_add` from
> `l2cap_create_chan`. This way, it only allocates but does not attach
> to global_l until __l2cap_chan_add is called which then handles the
> addition.
Could you please clarify what is "not removing `list_add` from
`l2cap_chan_create`"? I am not touching that part of code nor removing
the `list_add`. Do you want me to correspond the `chan` lifetime to `chan_list`?
> Alternatively, we could allocate it first, given the
> circular dependency involving `l2cap_core`.c->l2cap_sock.c)
> new_connection -> l2cap_chan_create(l2cap_sock.c->l2cap_core.c) which
This will change the signature of `l2cap_ops.new_connection`, which will be a large
refactoring across multiple files.
Signature will be changed from
`struct l2cap_chan *(*new_connection) (struct l2cap_chan *chan);`
to
`void (*new_connection) (struct l2cap_chan *chan, struct l2cap_chan *new_chan)`
Do you want me to this in this patch or in the follow up patch?
If in this patch, I will drop the backport cc to stable.
> makes the code rather hard to follow.
>
I totally understand this will create a maintenance problem. I created this patch
mainly because it can be easily to be backported to the stable branches and it
is the safest fix (though ugly). I can send a follow up patch for this to refactor it
according to your suggestions.
>> release_sock(parent);
>>
>> - return l2cap_pi(sk)->chan;
>> + return child_chan;
>> }
>>
>> static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
>> diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
>> index 1739c1989dbd..9796c3030434 100644
>> --- a/net/bluetooth/smp.c
>> +++ b/net/bluetooth/smp.c
>> @@ -3231,6 +3231,11 @@ static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
>>
>> BT_DBG("created chan %p", chan);
>>
>> + /* Match the put that the caller of ops->new_connection() performs
>> + * once it is done with the returned channel pointer.
>> + */
>> + l2cap_chan_hold(chan);
>> +
>> return chan;
>> }
>>
>> --
>> 2.54.0
>>
>
>
> --
> Luiz Augusto von Dentz
Best,
Siwei
^ permalink raw reply
* RE: [BlueZ,v2,1/1] shared/bap: set QoS state when CIS is lost
From: bluez.test.bot @ 2026-05-14 12:17 UTC (permalink / raw)
To: linux-bluetooth, raghavendra.rao
In-Reply-To: <20260514100545.54572-2-raghavendra.rao@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 1600 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094712
---Test result---
Test Summary:
CheckPatch PASS 0.40 seconds
GitLint PASS 0.29 seconds
BuildEll PASS 20.02 seconds
BluezMake PASS 614.31 seconds
MakeCheck PASS 12.67 seconds
MakeDistcheck PASS 233.13 seconds
CheckValgrind PASS 253.24 seconds
CheckSmatch WARNING 320.88 seconds
bluezmakeextell PASS 164.03 seconds
IncrementalBuild PASS 603.36 seconds
ScanBuild PASS 908.51 seconds
Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
https://github.com/bluez/bluez/pull/2127
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [Bug 221511] MT7925 7.1 rc does not work, but it works in kernel 7.0
From: bugzilla-daemon @ 2026-05-14 12:13 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-221511-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=221511
--- Comment #2 from Artem S. Tashkinov (aros@gmx.com) ---
Please bisect:
https://docs.kernel.org/admin-guide/bug-bisect.html
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* [PATCH v2] Bluetooth: btnxpuart: Fix use-after-free in probe error path
From: Zhao Dongdong @ 2026-05-14 11:40 UTC (permalink / raw)
To: amitkumar.karwar, neeraj.sanjaykale, marcel
Cc: linux-bluetooth, Zhao Dongdong
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
In nxp_serdev_probe(), if hci_register_dev() succeeds but ps_setup()
fails, the error path jumps to 'probe_fail' which only calls
hci_free_dev() and asserts the reset GPIO, but does NOT call
hci_unregister_dev() first.
This leaves the HCI device registered in the system with its backing
memory freed, leading to a use-after-free when userspace subsequently
accesses the device (e.g. via hciconfig or bluetoothd).
Fix by adding a 'probe_fail_unregister' label that calls
hci_unregister_dev() before falling through to the existing
'probe_fail' label. The original 'probe_fail' label is preserved
for the case where hci_register_dev() itself fails (device was
never registered, so no unregister is needed).
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
v2: Fix SubjectPrefix
v1: https://lore.kernel.org/linux-bluetooth/tencent_05373BA21CEEB5195F2ECCED0C77D0C57108@qq.com/
---
drivers/bluetooth/btnxpuart.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index e7036a48ce48..a4d7747e5be0 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1907,13 +1907,15 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
}
if (ps_setup(hdev))
- goto probe_fail;
+ goto probe_fail_unregister;
hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
nxp_coredump_notify);
return 0;
+probe_fail_unregister:
+ hci_unregister_dev(hdev);
probe_fail:
reset_control_assert(nxpdev->pdn);
hci_free_dev(hdev);
--
2.25.1
^ permalink raw reply related
* Re: MT7922 does not work in 7.1-rc3, works ok in 7.0
From: Pauli Virtanen @ 2026-05-14 11:31 UTC (permalink / raw)
To: Taneli Vähäkangas, linux-bluetooth
In-Reply-To: <46f7ee10-3fa8-490c-bb17-5929229206fa@vii.li>
Hi,
to, 2026-05-14 kello 12:57 +0300, Taneli Vähäkangas kirjoitti:
> Hey, this might be also a mishap on my side, not yet familiar enough
> with pacman to say with certainty I didn't mess up something (like
> firmware loading), but here goes anyway.
>
> Bluetooth is provided by:
> Bus 001 Device 003: ID 0e8d:0616 MediaTek Inc. Wireless_Device
> I believe. This is a gmktec nucbox k8 plus by dmi information.
>
> With distribution's 7.0 kernel bluetooth shows up fine in Gnome and I
> can connect my headphones and get audio. Using "linux-git" package,
> which built 7.1-rc3 (+ some commits on top in torvalds tree). Booting to
> it, bluetooth can't be enabled in Gnome, everything stays grayed out and
> no devices are shown. (I tried 7.1-rc1 earlier, which also didn't work,
> but I didn't take any notes back then.)
>
> The difference in dmesg is that on 7.0:
> [ 6.152649] Bluetooth: hci0: Device setup in 173263 usecs
> [ 6.152661] Bluetooth: hci0: HCI Enhanced Setup Synchronous
> Connection command is advertised, but not supported.
> [ 6.216582] Bluetooth: hci0: AOSP extensions version v1.00
> [ 6.216593] Bluetooth: hci0: AOSP quality report is supported
> 8<-- 8<--
>
> And on 7.1-rc3:
> [ 6.270455] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
> [ 6.270466] Bluetooth: hci0: HCI Enhanced Setup Synchronous
> Connection command is advertised, but not supported.
> 8<-- 8<--
This has fix pending
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=162b1adeb057d28ad84fd8a03f3c50cf08db5c62
>
> There are some changes in btmtk.c between these versions, but can't see
> on glance anything wrong with them, only adding support for MT6639.
>
> I'm not on the list, please Cc: if I can provide more info.
>
> Cheers,
>
> Taneli
--
Pauli Virtanen
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-05-14 11:24 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1094333
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] f2d501: shared/bap: set QoS state when CIS is lost
From: raghava447 @ 2026-05-14 11:24 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1094712
Home: https://github.com/bluez/bluez
Commit: f2d501a965dcdd505bde4903c38fe58acf9cb0cb
https://github.com/bluez/bluez/commit/f2d501a965dcdd505bde4903c38fe58acf9cb0cb
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-05-14 (Thu, 14 May 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: set QoS state when CIS is lost
This is used to pass PTS tests BAP/USR/SCC/BV-167-C
and BAP/USR/SCC/BV-168-C.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v2 1/1] shared/bap: set QoS state when CIS is lost
From: raghu447 @ 2026-05-14 10:05 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260514100545.54572-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
This is used to pass PTS tests BAP/USR/SCC/BV-167-C
and BAP/USR/SCC/BV-168-C.
---
src/shared/bap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/shared/bap.c b/src/shared/bap.c
index 78ba22259..60710a806 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -3028,6 +3028,10 @@ static void bap_stream_set_io(void *data, void *user_data)
else
bt_bap_stream_start(stream, NULL, NULL);
break;
+ case BT_BAP_STREAM_STATE_STREAMING:
+ if (fd < 0)
+ stream_set_state(stream, BT_BAP_STREAM_STATE_QOS);
+ break;
case BT_BAP_STREAM_STATE_DISABLING:
if (fd < 0)
bt_bap_stream_stop(stream, NULL, NULL);
--
2.43.0
^ permalink raw reply related
* [PATCH BlueZ v2 0/1] shared/bap: set QoS state when CIS is lost
From: raghu447 @ 2026-05-14 10:05 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghu447
In-Reply-To: <CABBYNZLcvmErUXHUXnAJOMv+saSP7aodVtfRV0QnL2-yXg=z2w@mail.gmail.com>
This is used to pass PTS tests BAP/USR/SCC/BV-167-C
and BAP/USR/SCC/BV-168-C.
raghavendra (1):
shared/bap: set QoS state when CIS is lost
src/shared/bap.c | 4 ++++
1 file changed, 4 insertions(+)
--
2.43.0
^ permalink raw reply
* MT7922 does not work in 7.1-rc3, works ok in 7.0
From: Taneli Vähäkangas @ 2026-05-14 9:57 UTC (permalink / raw)
To: linux-bluetooth
Hey, this might be also a mishap on my side, not yet familiar enough
with pacman to say with certainty I didn't mess up something (like
firmware loading), but here goes anyway.
Bluetooth is provided by:
Bus 001 Device 003: ID 0e8d:0616 MediaTek Inc. Wireless_Device
I believe. This is a gmktec nucbox k8 plus by dmi information.
With distribution's 7.0 kernel bluetooth shows up fine in Gnome and I
can connect my headphones and get audio. Using "linux-git" package,
which built 7.1-rc3 (+ some commits on top in torvalds tree). Booting to
it, bluetooth can't be enabled in Gnome, everything stays grayed out and
no devices are shown. (I tried 7.1-rc1 earlier, which also didn't work,
but I didn't take any notes back then.)
The difference in dmesg is that on 7.0:
[ 6.152649] Bluetooth: hci0: Device setup in 173263 usecs
[ 6.152661] Bluetooth: hci0: HCI Enhanced Setup Synchronous
Connection command is advertised, but not supported.
[ 6.216582] Bluetooth: hci0: AOSP extensions version v1.00
[ 6.216593] Bluetooth: hci0: AOSP quality report is supported
8<-- 8<--
And on 7.1-rc3:
[ 6.270455] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[ 6.270466] Bluetooth: hci0: HCI Enhanced Setup Synchronous
Connection command is advertised, but not supported.
8<-- 8<--
There are some changes in btmtk.c between these versions, but can't see
on glance anything wrong with them, only adding support for MT6639.
I'm not on the list, please Cc: if I can provide more info.
Cheers,
Taneli
^ permalink raw reply
* RE: bluetooth: btnxpuart: Fix use-after-free in probe error path
From: bluez.test.bot @ 2026-05-14 8:18 UTC (permalink / raw)
To: linux-bluetooth, winter91
In-Reply-To: <tencent_05373BA21CEEB5195F2ECCED0C77D0C57108@qq.com>
[-- Attachment #1: Type: text/plain, Size: 1057 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094596
---Test result---
Test Summary:
CheckPatch PASS 0.73 seconds
GitLint PASS 0.34 seconds
SubjectPrefix FAIL 0.13 seconds
BuildKernel PASS 25.79 seconds
CheckAllWarning PASS 28.12 seconds
CheckSparse PASS 26.37 seconds
BuildKernel32 PASS 25.28 seconds
TestRunnerSetup PASS 535.46 seconds
IncrementalBuild PASS 24.70 seconds
Details
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
https://github.com/bluez/bluetooth-next/pull/187
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluetooth-next:master] BUILD SUCCESS a9a4dd96b77c5999153a555c1e1ca0e95ec841ab
From: kernel test robot @ 2026-05-14 6:50 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
branch HEAD: a9a4dd96b77c5999153a555c1e1ca0e95ec841ab Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
elapsed time: 803m
configs tested: 252
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-23
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001 gcc-8.5.0
arc randconfig-001-20260514 clang-23
arc randconfig-001-20260514 gcc-8.5.0
arc randconfig-002 gcc-8.5.0
arc randconfig-002-20260514 clang-23
arc randconfig-002-20260514 gcc-8.5.0
arm allnoconfig clang-23
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm defconfig gcc-15.2.0
arm randconfig-001 gcc-8.5.0
arm randconfig-001-20260514 clang-23
arm randconfig-001-20260514 gcc-8.5.0
arm randconfig-002 gcc-8.5.0
arm randconfig-002-20260514 clang-23
arm randconfig-002-20260514 gcc-8.5.0
arm randconfig-003 gcc-8.5.0
arm randconfig-003-20260514 clang-23
arm randconfig-003-20260514 gcc-8.5.0
arm randconfig-004 gcc-8.5.0
arm randconfig-004-20260514 clang-23
arm randconfig-004-20260514 gcc-8.5.0
arm vf610m4_defconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260514 clang-23
arm64 randconfig-002-20260514 clang-23
arm64 randconfig-003-20260514 clang-23
arm64 randconfig-004-20260514 clang-23
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260514 clang-23
csky randconfig-002-20260514 clang-23
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001 gcc-11.5.0
hexagon randconfig-001-20260514 gcc-10.5.0
hexagon randconfig-002 gcc-11.5.0
hexagon randconfig-002-20260514 gcc-10.5.0
i386 allmodconfig clang-20
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001 gcc-14
i386 buildonly-randconfig-001-20260514 gcc-14
i386 buildonly-randconfig-002 gcc-14
i386 buildonly-randconfig-002-20260514 gcc-14
i386 buildonly-randconfig-003 gcc-14
i386 buildonly-randconfig-003-20260514 gcc-14
i386 buildonly-randconfig-004 gcc-14
i386 buildonly-randconfig-004-20260514 gcc-14
i386 buildonly-randconfig-005 gcc-14
i386 buildonly-randconfig-005-20260514 gcc-14
i386 buildonly-randconfig-006 gcc-14
i386 buildonly-randconfig-006-20260514 gcc-14
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260514 clang-20
i386 randconfig-002-20260514 clang-20
i386 randconfig-003-20260514 clang-20
i386 randconfig-004-20260514 clang-20
i386 randconfig-005-20260514 clang-20
i386 randconfig-006-20260514 clang-20
i386 randconfig-007-20260514 clang-20
i386 randconfig-011-20260514 clang-20
i386 randconfig-012-20260514 clang-20
i386 randconfig-013-20260514 clang-20
i386 randconfig-014-20260514 clang-20
i386 randconfig-015-20260514 clang-20
i386 randconfig-016-20260514 clang-20
i386 randconfig-017-20260514 clang-20
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-23
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001 gcc-11.5.0
loongarch randconfig-001-20260514 gcc-10.5.0
loongarch randconfig-002 gcc-11.5.0
loongarch randconfig-002-20260514 gcc-10.5.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k defconfig clang-19
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips maltasmvp_defconfig gcc-15.2.0
mips qi_lb60_defconfig clang-23
nios2 allmodconfig clang-23
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-19
nios2 randconfig-001 gcc-11.5.0
nios2 randconfig-001-20260514 gcc-10.5.0
nios2 randconfig-002 gcc-11.5.0
nios2 randconfig-002-20260514 gcc-10.5.0
openrisc allmodconfig clang-23
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001 gcc-13.4.0
parisc randconfig-001-20260514 gcc-13.4.0
parisc randconfig-002 gcc-13.4.0
parisc randconfig-002-20260514 gcc-13.4.0
parisc64 defconfig clang-19
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001 gcc-13.4.0
powerpc randconfig-001-20260514 gcc-13.4.0
powerpc randconfig-002 gcc-13.4.0
powerpc randconfig-002-20260514 gcc-13.4.0
powerpc tqm8541_defconfig clang-23
powerpc64 randconfig-001 gcc-13.4.0
powerpc64 randconfig-001-20260514 gcc-13.4.0
powerpc64 randconfig-002 gcc-13.4.0
powerpc64 randconfig-002-20260514 gcc-13.4.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260514 gcc-14.3.0
riscv randconfig-002-20260514 gcc-14.3.0
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260514 gcc-14.3.0
s390 randconfig-002-20260514 gcc-14.3.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-23
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh randconfig-001-20260514 gcc-14.3.0
sh randconfig-002-20260514 gcc-14.3.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001 gcc-15.2.0
sparc randconfig-001-20260514 gcc-15.2.0
sparc randconfig-002 gcc-15.2.0
sparc randconfig-002-20260514 gcc-15.2.0
sparc64 allmodconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001 gcc-15.2.0
sparc64 randconfig-001-20260514 gcc-15.2.0
sparc64 randconfig-002 gcc-15.2.0
sparc64 randconfig-002-20260514 gcc-15.2.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001 gcc-15.2.0
um randconfig-001-20260514 gcc-15.2.0
um randconfig-002 gcc-15.2.0
um randconfig-002-20260514 gcc-15.2.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-23
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001 clang-20
x86_64 buildonly-randconfig-001-20260514 clang-20
x86_64 buildonly-randconfig-002 clang-20
x86_64 buildonly-randconfig-002-20260514 clang-20
x86_64 buildonly-randconfig-003 clang-20
x86_64 buildonly-randconfig-003-20260514 clang-20
x86_64 buildonly-randconfig-004 clang-20
x86_64 buildonly-randconfig-004-20260514 clang-20
x86_64 buildonly-randconfig-005 clang-20
x86_64 buildonly-randconfig-005-20260514 clang-20
x86_64 buildonly-randconfig-006 clang-20
x86_64 buildonly-randconfig-006-20260514 clang-20
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001 gcc-14
x86_64 randconfig-001-20260514 gcc-14
x86_64 randconfig-002 gcc-14
x86_64 randconfig-002-20260514 gcc-14
x86_64 randconfig-003 gcc-14
x86_64 randconfig-003-20260514 gcc-14
x86_64 randconfig-004 gcc-14
x86_64 randconfig-004-20260514 gcc-14
x86_64 randconfig-005 gcc-14
x86_64 randconfig-005-20260514 gcc-14
x86_64 randconfig-006 gcc-14
x86_64 randconfig-006-20260514 gcc-14
x86_64 randconfig-011-20260514 clang-20
x86_64 randconfig-012-20260514 clang-20
x86_64 randconfig-013-20260514 clang-20
x86_64 randconfig-014-20260514 clang-20
x86_64 randconfig-015-20260514 clang-20
x86_64 randconfig-016-20260514 clang-20
x86_64 randconfig-071-20260514 clang-20
x86_64 randconfig-072-20260514 clang-20
x86_64 randconfig-072-20260514 gcc-14
x86_64 randconfig-073-20260514 clang-20
x86_64 randconfig-074-20260514 clang-20
x86_64 randconfig-074-20260514 gcc-14
x86_64 randconfig-075-20260514 clang-20
x86_64 randconfig-076-20260514 clang-20
x86_64 randconfig-076-20260514 gcc-13
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-23
xtensa allyesconfig gcc-15.2.0
xtensa randconfig-001 gcc-15.2.0
xtensa randconfig-001-20260514 gcc-15.2.0
xtensa randconfig-002 gcc-15.2.0
xtensa randconfig-002-20260514 gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox