* [RFC PATCH 0/5] Bluetooth: enable context analysis
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
Set up compiler context analysis that generate compiler warnings on
problems that Clang -Wthread-safety can detect:
https://docs.kernel.org/dev-tools/context-analysis.html
Clang 22, and probably Clang 23 [1] will be required. Sparse locking
analysis support was removed in commit
5b63d0ae94ccfd64dcbdb693d88eb3650eb3c64c, this is its successor.
This series enables the analysis and adds minimal annotations to silence
some false positives.
Also, one patch to fix what looks like a legitimate locking issue in
iso.c.
In future, it probably is a good idea to make more use of it and add
__must_hold, __guarded_by etc annotations.
Kernel test robot appears to be checking for these, but not sure in what
trees [2]
BlueZ testbot doesn't check these currently but it's possible to add
https://github.com/bluez/action-ci/pull/4
[1] https://lore.kernel.org/all/CANpmjNN4O=W70sAc5gaVkTAFdrGGOW+XBMyuehfz3_QMiT=uCw@mail.gmail.com/
[2] https://lore.kernel.org/all/202605060005.JYWpZXr2-lkp@intel.com/
Pauli Virtanen (5):
Bluetooth: af_bluetooth: Add minimal context analysis annotations
Bluetooth: hci_core: Add minimal context analysis annotations
Bluetooth: ISO: lock same hdev as what is released
Bluetooth: L2CAP: Add minimal context analysis annotations
Bluetooth: enable context analysis
drivers/bluetooth/Makefile | 2 ++
net/bluetooth/Makefile | 2 ++
net/bluetooth/af_bluetooth.c | 7 +++++--
net/bluetooth/hci_core.c | 3 +++
net/bluetooth/iso.c | 14 ++++++++------
net/bluetooth/l2cap_sock.c | 1 +
6 files changed, 21 insertions(+), 8 deletions(-)
--
2.54.0
^ permalink raw reply
* [RFC PATCH 2/5] Bluetooth: hci_core: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>
Add minimal compiler context analysis annotations, required for
compilation to pass.
compiler-context-analysis.h doesn't have tools to deal with the
conditional SRCU locking on return value used here, so just disable the
analysis in places.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
net/bluetooth/hci_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c46c1236ebfa..fa87cb0bcf7b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -65,6 +65,7 @@ static DEFINE_IDA(hci_index_ida);
/* Get HCI device by index.
* Device is held on return. */
static struct hci_dev *__hci_dev_get(int index, int *srcu_index)
+ __context_unsafe(/* conditional locking */)
{
struct hci_dev *hdev = NULL, *d;
@@ -92,11 +93,13 @@ struct hci_dev *hci_dev_get(int index)
}
static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index)
+ __context_unsafe(/* conditional locking vs return */)
{
return __hci_dev_get(index, srcu_index);
}
static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index)
+ __context_unsafe(/* conditional locking vs return */)
{
srcu_read_unlock(&hdev->srcu, srcu_index);
hci_dev_put(hdev);
--
2.54.0
^ permalink raw reply related
* [RFC PATCH 1/5] Bluetooth: af_bluetooth: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>
Add minimal compiler context analysis annotations, required for
compilation to pass.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
net/bluetooth/af_bluetooth.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9d68dd86023c..f42467159947 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -212,6 +212,7 @@ bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
EXPORT_SYMBOL(bt_sock_linked);
void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
+ __context_unsafe(/* conditional locking */)
{
const struct cred *old_cred;
struct pid *old_pid;
@@ -819,7 +820,8 @@ EXPORT_SYMBOL(bt_sock_wait_ready);
#ifdef CONFIG_PROC_FS
static void *bt_seq_start(struct seq_file *seq, loff_t *pos)
- __acquires(seq->private->l->lock)
+ __acquires_shared(&((struct bt_sock_list *)
+ pde_data(file_inode(seq->file)))->lock)
{
struct bt_sock_list *l = pde_data(file_inode(seq->file));
@@ -835,7 +837,8 @@ static void *bt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
}
static void bt_seq_stop(struct seq_file *seq, void *v)
- __releases(seq->private->l->lock)
+ __releases_shared(&((struct bt_sock_list *)
+ pde_data(file_inode(seq->file)))->lock)
{
struct bt_sock_list *l = pde_data(file_inode(seq->file));
--
2.54.0
^ permalink raw reply related
* [RFC PATCH 3/5] Bluetooth: ISO: lock same hdev as what is released
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>
bis may be deleted concurrently after release_sock(sk).
To avoid this, lock the hdev obtained in iso_conn_get_hdev that we have
refcount for. Also, obtain refcount on the hci_conn to avoid comparing
freed pointer in the race check below.
Addresses valid context analysis warning
net/bluetooth/iso.c:1095:2: warning: releasing mutex 'iso_conn_get_hdev(sk->conn).lock'
that was not held [-Wthread-safety-analysis]
Fixes: d3413703d5f8b ("Bluetooth: ISO: Add support to bind to trigger PAST")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
net/bluetooth/iso.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7cb2864fe872..34991fc7e0a7 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1027,13 +1027,16 @@ static int iso_sock_rebind_bis(struct sock *sk, struct sockaddr_iso *sa,
return err;
}
-static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn)
+static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn,
+ struct hci_conn **hcon)
{
struct hci_dev *hdev = NULL;
iso_conn_lock(conn);
- if (conn->hcon)
+ if (conn->hcon) {
hdev = hci_dev_hold(conn->hcon->hdev);
+ *hcon = hci_conn_get(conn->hcon);
+ }
iso_conn_unlock(conn);
return hdev;
@@ -1065,18 +1068,16 @@ static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa,
if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type))
return -EINVAL;
- hdev = iso_conn_get_hdev(iso_pi(sk)->conn);
+ hdev = iso_conn_get_hdev(iso_pi(sk)->conn, &bis);
if (!hdev)
return -EINVAL;
- bis = iso_pi(sk)->conn->hcon;
-
/* Release the socket before lookups since that requires hci_dev_lock
* which shall not be acquired while holding sock_lock for proper
* ordering.
*/
release_sock(sk);
- hci_dev_lock(bis->hdev);
+ hci_dev_lock(hdev);
lock_sock(sk);
if (!iso_pi(sk)->conn || iso_pi(sk)->conn->hcon != bis) {
@@ -1093,6 +1094,7 @@ static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa,
unlock:
hci_dev_unlock(hdev);
+ hci_conn_put(bis);
hci_dev_put(hdev);
return err;
--
2.54.0
^ permalink raw reply related
* [RFC PATCH 4/5] Bluetooth: L2CAP: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>
Context analysis has what looks like false positive vs. taking
conn->lock in l2cap_sock_shutdown().
chan->conn may be deleted concurrently and become NULL while retaking
chan->lock, but since chan shall not be reused, chan->conn cannot be
replaced by a different l2cap_conn.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
net/bluetooth/l2cap_sock.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index cf590a67d364..bbf883098b7f 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1336,6 +1336,7 @@ static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
}
static int l2cap_sock_shutdown(struct socket *sock, int how)
+ __context_unsafe(/* complex chan->conn locking */)
{
struct sock *sk = sock->sk;
struct l2cap_chan *chan;
--
2.54.0
^ permalink raw reply related
* [RFC PATCH 5/5] Bluetooth: enable context analysis
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>
Enable compiler context analysis for Bluetooth subsystem and drivers.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
drivers/bluetooth/Makefile | 2 ++
net/bluetooth/Makefile | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index bafc26250b63..e6b1c1180d1d 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -50,3 +50,5 @@ hci_uart-$(CONFIG_BT_HCIUART_AG6XX) += hci_ag6xx.o
hci_uart-$(CONFIG_BT_HCIUART_MRVL) += hci_mrvl.o
hci_uart-$(CONFIG_BT_HCIUART_AML) += hci_aml.o
hci_uart-objs := $(hci_uart-y)
+
+CONTEXT_ANALYSIS := y
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 41049b280887..ff466ea97436 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -25,3 +25,5 @@ bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o
bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o
bluetooth-$(CONFIG_BT_DEBUGFS) += hci_debugfs.o
bluetooth-$(CONFIG_BT_SELFTEST) += selftest.o
+
+CONTEXT_ANALYSIS := y
--
2.54.0
^ permalink raw reply related
* [bluetooth-next:master] BUILD SUCCESS 6aba94a49bc9cc5477e56053bfe5d70a123f9aed
From: kernel test robot @ 2026-05-16 12:22 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
branch HEAD: 6aba94a49bc9cc5477e56053bfe5d70a123f9aed Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
elapsed time: 1118m
configs tested: 222
configs skipped: 11
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-23
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001 gcc-8.5.0
arc randconfig-001-20260516 gcc-8.5.0
arc randconfig-002 gcc-8.5.0
arc randconfig-002-20260516 gcc-8.5.0
arm allnoconfig clang-23
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm defconfig gcc-15.2.0
arm randconfig-001 gcc-8.5.0
arm randconfig-001-20260516 gcc-8.5.0
arm randconfig-002 gcc-8.5.0
arm randconfig-002-20260516 gcc-8.5.0
arm randconfig-003 gcc-8.5.0
arm randconfig-003-20260516 gcc-8.5.0
arm randconfig-004 gcc-8.5.0
arm randconfig-004-20260516 gcc-8.5.0
arm64 allmodconfig clang-19
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260516 gcc-9.5.0
arm64 randconfig-002-20260516 gcc-9.5.0
arm64 randconfig-003-20260516 gcc-9.5.0
arm64 randconfig-004-20260516 gcc-9.5.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260516 gcc-9.5.0
csky randconfig-002-20260516 gcc-9.5.0
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001-20260516 gcc-11.5.0
hexagon randconfig-002-20260516 gcc-11.5.0
i386 alldefconfig gcc-14
i386 allmodconfig clang-20
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 buildonly-randconfig-001 clang-20
i386 buildonly-randconfig-001-20260516 clang-20
i386 buildonly-randconfig-002 clang-20
i386 buildonly-randconfig-002-20260516 clang-20
i386 buildonly-randconfig-003 clang-20
i386 buildonly-randconfig-003-20260516 clang-20
i386 buildonly-randconfig-004 clang-20
i386 buildonly-randconfig-004-20260516 clang-20
i386 buildonly-randconfig-005 clang-20
i386 buildonly-randconfig-005-20260516 clang-20
i386 buildonly-randconfig-006 clang-20
i386 buildonly-randconfig-006-20260516 clang-20
i386 defconfig gcc-15.2.0
i386 randconfig-001 clang-20
i386 randconfig-001-20260516 clang-20
i386 randconfig-002 clang-20
i386 randconfig-002-20260516 clang-20
i386 randconfig-003 clang-20
i386 randconfig-003-20260516 clang-20
i386 randconfig-004 clang-20
i386 randconfig-004-20260516 clang-20
i386 randconfig-005 clang-20
i386 randconfig-005-20260516 clang-20
i386 randconfig-006 clang-20
i386 randconfig-006-20260516 clang-20
i386 randconfig-007 clang-20
i386 randconfig-007-20260516 clang-20
i386 randconfig-011-20260516 gcc-14
i386 randconfig-012-20260516 gcc-14
i386 randconfig-013-20260516 gcc-14
i386 randconfig-014-20260516 gcc-14
i386 randconfig-015-20260516 gcc-14
i386 randconfig-016-20260516 gcc-14
i386 randconfig-017-20260516 gcc-14
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-23
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001-20260516 gcc-11.5.0
loongarch randconfig-002-20260516 gcc-11.5.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k defconfig clang-19
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips ip32_defconfig clang-23
nios2 allmodconfig clang-23
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-19
nios2 randconfig-001-20260516 gcc-11.5.0
nios2 randconfig-002-20260516 gcc-11.5.0
openrisc allmodconfig clang-23
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001-20260516 gcc-12.5.0
parisc randconfig-002-20260516 gcc-12.5.0
parisc64 defconfig clang-19
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001-20260516 gcc-12.5.0
powerpc randconfig-002-20260516 gcc-12.5.0
powerpc tqm8560_defconfig gcc-15.2.0
powerpc64 randconfig-001-20260516 gcc-12.5.0
powerpc64 randconfig-002-20260516 gcc-12.5.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260516 gcc-15.2.0
riscv randconfig-002-20260516 gcc-15.2.0
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260516 gcc-15.2.0
s390 randconfig-002-20260516 gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-23
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh randconfig-001-20260516 gcc-15.2.0
sh randconfig-002-20260516 gcc-15.2.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001-20260516 gcc-8.5.0
sparc randconfig-002-20260516 gcc-8.5.0
sparc64 allmodconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260516 gcc-8.5.0
sparc64 randconfig-002-20260516 gcc-8.5.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260516 gcc-8.5.0
um randconfig-002-20260516 gcc-8.5.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-23
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001-20260516 gcc-14
x86_64 buildonly-randconfig-002-20260516 gcc-14
x86_64 buildonly-randconfig-003-20260516 gcc-14
x86_64 buildonly-randconfig-004-20260516 gcc-14
x86_64 buildonly-randconfig-005-20260516 gcc-14
x86_64 buildonly-randconfig-006-20260516 gcc-14
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260516 gcc-14
x86_64 randconfig-002-20260516 gcc-14
x86_64 randconfig-003-20260516 gcc-14
x86_64 randconfig-004-20260516 gcc-14
x86_64 randconfig-005-20260516 gcc-14
x86_64 randconfig-006-20260516 gcc-14
x86_64 randconfig-011 clang-20
x86_64 randconfig-011-20260516 clang-20
x86_64 randconfig-012 clang-20
x86_64 randconfig-012-20260516 clang-20
x86_64 randconfig-013 clang-20
x86_64 randconfig-013-20260516 clang-20
x86_64 randconfig-014 clang-20
x86_64 randconfig-014-20260516 clang-20
x86_64 randconfig-015 clang-20
x86_64 randconfig-015-20260516 clang-20
x86_64 randconfig-016 clang-20
x86_64 randconfig-016-20260516 clang-20
x86_64 randconfig-071-20260516 gcc-14
x86_64 randconfig-072-20260516 gcc-14
x86_64 randconfig-073-20260516 gcc-14
x86_64 randconfig-074-20260516 gcc-14
x86_64 randconfig-075-20260516 gcc-14
x86_64 randconfig-076-20260516 gcc-14
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-23
xtensa randconfig-001-20260516 gcc-8.5.0
xtensa randconfig-002-20260516 gcc-8.5.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* RE: Bluetooth: enable context analysis
From: bluez.test.bot @ 2026-05-16 12:46 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <342a530a1756cfd136542a33e5d947fd6c0a85d2.1778930064.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 2120 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095802
---Test result---
Test Summary:
CheckPatch PASS 3.56 seconds
GitLint FAIL 1.79 seconds
SubjectPrefix PASS 0.59 seconds
BuildKernel PASS 26.34 seconds
CheckAllWarning PASS 29.76 seconds
CheckSparse PASS 30.21 seconds
BuildKernel32 PASS 28.37 seconds
TestRunnerSetup PASS 552.61 seconds
TestRunner_l2cap-tester PASS 379.41 seconds
TestRunner_iso-tester PASS 591.09 seconds
TestRunner_bnep-tester PASS 18.71 seconds
TestRunner_mgmt-tester PASS 2023.25 seconds
TestRunner_rfcomm-tester PASS 63.64 seconds
TestRunner_sco-tester PASS 141.94 seconds
TestRunner_ioctl-tester PASS 133.61 seconds
TestRunner_mesh-tester PASS 60.34 seconds
TestRunner_smp-tester PASS 18.18 seconds
TestRunner_userchan-tester PASS 19.47 seconds
TestRunner_6lowpan-tester PASS 51.14 seconds
IncrementalBuild PASS 32.11 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[RFC,3/5] Bluetooth: ISO: lock same hdev as what is released
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
11: B1 Line exceeds max length (87>80): "net/bluetooth/iso.c:1095:2: warning: releasing mutex 'iso_conn_get_hdev(sk->conn).lock'"
https://github.com/bluez/bluetooth-next/pull/202
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: Safa Karakuş @ 2026-05-16 18:15 UTC (permalink / raw)
To: linux-bluetooth
Cc: Luiz Augusto von Dentz, Marcel Holtmann, stable, linux-kernel,
Safa Karakuş
In-Reply-To: <20260516092139.2618159-1-safa.karakus@secunnix.com>
bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
accept queue and release_sock()s it before returning, so the returned
sk has no caller reference and is unlocked.
l2cap_sock_cleanup_listen() walks these children on listening-socket
close. A concurrent HCI disconnect drives hci_rx_work ->
l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
BUG: KASAN: slab-use-after-free in l2cap_sock_kill
l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill
This is distinct from the two fixes already in this area: commit
e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the
accept_q list/poll and takes temporary refs inside bt_accept_dequeue(),
and CVE-2025-39860 serialises the userspace close()/accept() race by
calling cleanup_listen() under lock_sock() in l2cap_sock_release().
Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF
still reproduces on current bluetooth/master.
Take the reference at the source: bt_accept_dequeue() does sock_hold()
while sk is still locked, before release_sock(); callers sock_put().
cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under
a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops
it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on
SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under
the parent sk lock and that would invert
conn->lock -> chan->lock -> sk_lock (lockdep).
KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced
12 use-after-free reports per run before this change; 0, and no lockdep
report, over 1600+ raced iterations after it on bluetooth/master.
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Cc: stable@vger.kernel.org
Signed-off-by: Safa Karakuş <safa.karakus@secunnix.com>
---
Hi Luiz,
v4 - rebased on current bluetooth/master (after e83f5e24d "serialize
accept_q access"); the af_bluetooth.c hunk now sits in the reworked
bt_accept_dequeue(). This residual (cleanup_listen vs l2cap_conn_del,
not covered by e83f5e24d nor CVE-2025-39860) is unchanged from v3 and
re-verified with KASAN on bluetooth/master: 12 UAF/run -> 0, no
lockdep, over 1600+ raced iterations.
Changes since v3: rebased onto e83f5e24d; commit message notes why
e83f5e24d/CVE-2025-39860 do not cover this path.
Changes since v2: fix at the source in bt_accept_dequeue() + chan
lifetime via l2cap_chan_hold_unless_zero(); no conn->lock (lockdep).
Changes since v1: consistent From/Signed-off-by.
net/bluetooth/af_bluetooth.c | 10 +++++++
net/bluetooth/iso.c | 9 ++++++-
net/bluetooth/l2cap_sock.c | 51 +++++++++++++++++++++++++++++++-----
net/bluetooth/rfcomm/sock.c | 9 ++++++-
net/bluetooth/sco.c | 9 ++++++-
5 files changed, 78 insertions(+), 10 deletions(-)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9d68dd860..1a6aa3f8d 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -340,6 +340,16 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
if (newsock)
sock_graft(sk, newsock);
+ /* Hand the caller a reference taken while sk is
+ * still locked. bt_accept_unlink() just dropped
+ * the accept-queue reference; without this hold a
+ * concurrent teardown (e.g. l2cap_conn_del() ->
+ * l2cap_sock_kill()) could free sk between
+ * release_sock() and the caller using it. Every
+ * caller drops this with sock_put() when done.
+ */
+ sock_hold(sk);
+
release_sock(sk);
if (next)
sock_put(next);
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7cb2864fe..812f9002d 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -751,6 +751,8 @@ static void iso_sock_cleanup_listen(struct sock *parent)
while ((sk = bt_accept_dequeue(parent, NULL))) {
iso_sock_close(sk);
iso_sock_kill(sk);
+ /* Drop the reference handed back by bt_accept_dequeue(). */
+ sock_put(sk);
}
/* If listening socket has a hcon, properly disconnect it */
@@ -1356,8 +1358,13 @@ static int iso_sock_accept(struct socket *sock, struct socket *newsock,
}
ch = bt_accept_dequeue(sk, newsock);
- if (ch)
+ if (ch) {
+ /* Drop the bridging ref from bt_accept_dequeue();
+ * the grafted socket keeps ch alive from here.
+ */
+ sock_put(ch);
break;
+ }
if (!timeo) {
err = -EAGAIN;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index cf590a67d..b34e7da8d 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -349,8 +349,13 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
}
nsk = bt_accept_dequeue(sk, newsock);
- if (nsk)
+ if (nsk) {
+ /* Drop the bridging ref from bt_accept_dequeue();
+ * the grafted socket keeps nsk alive from here.
+ */
+ sock_put(nsk);
break;
+ }
if (!timeo) {
err = -EAGAIN;
@@ -1475,22 +1480,54 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
BT_DBG("parent %p state %s", parent,
state_to_string(parent->sk_state));
- /* Close not yet accepted channels */
+ /* Close not yet accepted channels.
+ *
+ * bt_accept_dequeue() now returns sk with an extra reference held
+ * (taken while sk was still locked) so a concurrent l2cap_conn_del()
+ * -> l2cap_sock_kill() cannot free sk under us.
+ *
+ * cleanup_listen() runs under the parent sk lock, so unlike
+ * l2cap_sock_shutdown() we must NOT take conn->lock here: that would
+ * establish sk_lock -> conn->lock and invert the established
+ * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock).
+ *
+ * Instead, briefly take the child sk lock to fetch and pin its chan.
+ * l2cap_conn_del() reaches the chan free only via
+ * l2cap_chan_del() -> l2cap_sock_teardown_cb(), which itself takes
+ * the child sk lock; holding it across l2cap_chan_hold_unless_zero()
+ * therefore guarantees the chan cannot be freed while we read and
+ * pin it (hold_unless_zero() additionally skips a chan already past
+ * its last reference). We then drop the sk lock before taking
+ * chan->lock, so sk and chan locks are never held together.
+ */
while ((sk = bt_accept_dequeue(parent, NULL))) {
- struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+ struct l2cap_chan *chan;
+
+ lock_sock_nested(sk, L2CAP_NESTING_NORMAL);
+ chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
+ release_sock(sk);
+ if (!chan) {
+ /* l2cap_conn_del() already tearing this child down */
+ sock_put(sk);
+ continue;
+ }
BT_DBG("child chan %p state %s", chan,
state_to_string(chan->state));
- l2cap_chan_hold(chan);
l2cap_chan_lock(chan);
-
__clear_chan_timer(chan);
l2cap_chan_close(chan, ECONNRESET);
- l2cap_sock_kill(sk);
-
+ /* l2cap_conn_del() may already have killed this socket
+ * (it sets SOCK_DEAD); skip the duplicate to avoid a
+ * double sock_put()/l2cap_chan_put().
+ */
+ if (!sock_flag(sk, SOCK_DEAD))
+ l2cap_sock_kill(sk);
l2cap_chan_unlock(chan);
+
l2cap_chan_put(chan);
+ sock_put(sk);
}
}
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index be6639cd6..bd7d959c6 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -180,6 +180,8 @@ static void rfcomm_sock_cleanup_listen(struct sock *parent)
while ((sk = bt_accept_dequeue(parent, NULL))) {
rfcomm_sock_close(sk);
rfcomm_sock_kill(sk);
+ /* Drop the reference handed back by bt_accept_dequeue(). */
+ sock_put(sk);
}
parent->sk_state = BT_CLOSED;
@@ -497,8 +499,13 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock,
}
nsk = bt_accept_dequeue(sk, newsock);
- if (nsk)
+ if (nsk) {
+ /* Drop the bridging ref from bt_accept_dequeue();
+ * the grafted socket keeps nsk alive from here.
+ */
+ sock_put(nsk);
break;
+ }
if (!timeo) {
err = -EAGAIN;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index eba44525d..f1799c6a6 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -502,6 +502,8 @@ static void sco_sock_cleanup_listen(struct sock *parent)
while ((sk = bt_accept_dequeue(parent, NULL))) {
sco_sock_close(sk);
sco_sock_kill(sk);
+ /* Drop the reference handed back by bt_accept_dequeue(). */
+ sock_put(sk);
}
parent->sk_state = BT_CLOSED;
@@ -765,8 +767,13 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock,
}
ch = bt_accept_dequeue(sk, newsock);
- if (ch)
+ if (ch) {
+ /* Drop the bridging ref from bt_accept_dequeue();
+ * the grafted socket keeps ch alive from here.
+ */
+ sock_put(ch);
break;
+ }
if (!timeo) {
err = -EAGAIN;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] Bluetooth: btmtk: Fix FUNC_CTRL parsing for devices with zero-length payloads
From: Tristan Madani @ 2026-05-16 19:15 UTC (permalink / raw)
To: shivamkalra98
Cc: marcel, luiz.dentz, matthias.bgg, angelogioacchino.delregno,
luiz.von.dentz, linux-bluetooth, linux-kernel, linux-arm-kernel,
linux-mediatek, stable
In-Reply-To: <20260514-bluetooh-fix-mt7922-v1-1-499c878af1e5@zohomail.in>
On Thu, 14 May 2026 23:18:13 +0530, Shivam Kalra wrote:
> Fix this by making skb_pull_data() conditional: if the status payload is
> present, parse it as before; if omitted, default to BTMTK_WMT_ON_UNDONE.
Makes sense. The original check was too strict for devices that
legitimately omit the status field on FUNC_CTRL responses.
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
^ permalink raw reply
* RE: [v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: bluez.test.bot @ 2026-05-16 20:47 UTC (permalink / raw)
To: linux-bluetooth, safa.karakus
In-Reply-To: <20260516181504.3076260-1-safa.karakus@secunnix.com>
[-- Attachment #1: Type: text/plain, Size: 1482 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095877
---Test result---
Test Summary:
CheckPatch PASS 1.32 seconds
GitLint PASS 0.22 seconds
SubjectPrefix PASS 0.08 seconds
BuildKernel PASS 23.87 seconds
CheckAllWarning PASS 26.65 seconds
CheckSparse PASS 25.16 seconds
BuildKernel32 PASS 23.25 seconds
TestRunnerSetup PASS 518.74 seconds
TestRunner_l2cap-tester PASS 375.73 seconds
TestRunner_iso-tester PASS 596.04 seconds
TestRunner_bnep-tester PASS 18.18 seconds
TestRunner_mgmt-tester PASS 2021.60 seconds
TestRunner_rfcomm-tester PASS 62.71 seconds
TestRunner_sco-tester PASS 140.77 seconds
TestRunner_ioctl-tester PASS 133.16 seconds
TestRunner_mesh-tester PASS 59.48 seconds
TestRunner_smp-tester PASS 17.61 seconds
TestRunner_userchan-tester PASS 18.69 seconds
TestRunner_6lowpan-tester PASS 50.66 seconds
IncrementalBuild PASS 22.44 seconds
https://github.com/bluez/bluetooth-next/pull/203
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: Hillf Danton @ 2026-05-16 22:40 UTC (permalink / raw)
To: Safa Karakus
Cc: linux-bluetooth, Luiz Augusto von Dentz, Marcel Holtmann, stable,
linux-kernel
In-Reply-To: <20260516181504.3076260-1-safa.karakus@secunnix.com>
On Sat, 16 May 2026 21:15:04 +0300 Safa Karakus wrote:
> bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
> accept queue and release_sock()s it before returning, so the returned
> sk has no caller reference and is unlocked.
>
> l2cap_sock_cleanup_listen() walks these children on listening-socket
> close. A concurrent HCI disconnect drives hci_rx_work ->
> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
> frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
>
> BUG: KASAN: slab-use-after-free in l2cap_sock_kill
> l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
> Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill
>
Feel free to add the regular KASAN uaf calltrace to help understand your fix.
^ permalink raw reply
* [PATCH v3] Bluetooth: btintel: Use skb_pull_data return for bounds check
From: Quan Sun @ 2026-05-17 6:01 UTC (permalink / raw)
To: marcel, luiz.dentz, kiran.k, linux-bluetooth; +Cc: Quan Sun
The length check at the top of btintel_print_fseq_info() verifies
the skb has at least 66 bytes (sizeof(u32) * 16 + 2), but the
function actually consumes 74 bytes (2 * 1 + 18 * 4). When firmware
returns a packet of exactly 66 bytes, the last two skb_pull_data()
calls return NULL, which is passed directly to get_unaligned_le32(),
resulting in a NULL pointer dereference.
Remove the insufficient length check and instead validate every
skb_pull_data() return value, branching to a malformed label that
logs the error and frees the skb.
Fixes: a7ba218a44aa ("Bluetooth: btintel: Print Firmware Sequencer information")
Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>
---
drivers/bluetooth/btintel.c | 106 +++++++++++++++++++++++++++---------
1 file changed, 79 insertions(+), 27 deletions(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 5e9cac090bd8..0c42ee53fe2e 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3358,14 +3358,9 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
return;
}
- if (skb->len < (sizeof(u32) * 16 + 2)) {
- bt_dev_dbg(hdev, "Malformed packet of length %u received",
- skb->len);
- kfree_skb(skb);
- return;
- }
-
p = skb_pull_data(skb, 1);
+ if (!p)
+ goto malformed;
if (*p) {
bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p);
kfree_skb(skb);
@@ -3373,6 +3368,8 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
}
p = skb_pull_data(skb, 1);
+ if (!p)
+ goto malformed;
switch (*p) {
case 0:
str = "Success";
@@ -3396,65 +3393,120 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Reason: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Global version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val);
- p = skb->data;
- skb_pull_data(skb, 4);
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
p[2], p[3]);
- p = skb->data;
- skb_pull_data(skb, 4);
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
p[2], p[3]);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val);
- val = get_unaligned_le32(skb_pull_data(skb, 4));
+ p = skb_pull_data(skb, 4);
+ if (!p)
+ goto malformed;
+ val = get_unaligned_le32(p);
bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val);
kfree_skb(skb);
+ return;
+
+malformed:
+ bt_dev_dbg(hdev, "Malformed packet received");
+ kfree_skb(skb);
}
EXPORT_SYMBOL_GPL(btintel_print_fseq_info);
--
2.34.1
^ permalink raw reply related
* [Bug 221524] Intel 8265 Bluetooth regression (BLE hearing aid unusable) in kernel 6.12 vs 6.1
From: bugzilla-daemon @ 2026-05-17 7:47 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-221524-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=221524
Artem S. Tashkinov (aros@gmx.com) changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* RE: [v3] Bluetooth: btintel: Use skb_pull_data return for bounds check
From: bluez.test.bot @ 2026-05-17 8:24 UTC (permalink / raw)
To: linux-bluetooth, 2022090917019
In-Reply-To: <20260517060142.24510-1-2022090917019@std.uestc.edu.cn>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095975
---Test result---
Test Summary:
CheckPatch PASS 0.78 seconds
GitLint PASS 0.32 seconds
SubjectPrefix PASS 0.13 seconds
BuildKernel PASS 25.20 seconds
CheckAllWarning PASS 27.50 seconds
CheckSparse PASS 28.68 seconds
BuildKernel32 PASS 24.76 seconds
TestRunnerSetup PASS 525.64 seconds
IncrementalBuild PASS 23.95 seconds
https://github.com/bluez/bluetooth-next/pull/204
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH BlueZ] media: use custom DBus timeouts only when remote side is waiting
From: Pauli Virtanen @ 2026-05-17 9:59 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
Under high system load (VM instance on boot) it's observed the 3 sec
timeout BlueZ uses for BAP broadcast SetConfiguration may be missed by
Wireplumber, as these are set up immediately on startup together with
any other setup (eg ALSA) that may need time.
There's no actual need for using a short custom timeout in BlueZ for
this, as in this case there is no remote side that is waiting for a reply.
Fix by limiting custom timeouts to cases where there is a waiting
remote. A2DP-specific timeout should be used only for A2DP
SetConfiguration. Similarly, using timeout for BAP only makes sense for
unicast, and should derive from the ATT timeout.
---
profiles/audio/media.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index cdaafb04e..0297e4c79 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -71,7 +71,11 @@
#define MEDIA_ENDPOINT_INTERFACE "org.bluez.MediaEndpoint1"
#define MEDIA_PLAYER_INTERFACE "org.mpris.MediaPlayer2.Player"
-#define REQUEST_TIMEOUT (3 * 1000) /* 3 seconds */
+/* Timeout should be less than avdtp request timeout (4 seconds) */
+#define A2DP_REQUEST_TIMEOUT_MSEC (3 * 1000)
+
+/* Timeout should be less than ATT timeout (30 seconds) */
+#define BAP_REQUEST_TIMEOUT_MSEC (20 * 1000)
struct media_app {
struct media_adapter *adapter;
@@ -465,16 +469,16 @@ static gboolean media_endpoint_async_call(DBusMessage *msg,
struct media_transport *transport,
media_endpoint_cb_t cb,
void *user_data,
- GDestroyNotify destroy)
+ GDestroyNotify destroy,
+ int timeout_msec)
{
struct endpoint_request *request;
request = g_new0(struct endpoint_request, 1);
- /* Timeout should be less than avdtp request timeout (4 seconds) */
if (g_dbus_send_message_with_reply(btd_get_dbus_connection(),
msg, &request->call,
- REQUEST_TIMEOUT) == FALSE) {
+ timeout_msec) == FALSE) {
error("D-Bus send failed");
g_free(request);
return FALSE;
@@ -521,7 +525,7 @@ static gboolean select_configuration(struct media_endpoint *endpoint,
DBUS_TYPE_INVALID);
return media_endpoint_async_call(msg, endpoint, NULL,
- cb, user_data, destroy);
+ cb, user_data, destroy, -1);
}
static int transport_device_cmp(gconstpointer data, gconstpointer user_data)
@@ -604,7 +608,8 @@ static gboolean set_configuration(struct media_endpoint *endpoint,
g_dbus_get_properties(conn, path, "org.bluez.MediaTransport1", &iter);
return media_endpoint_async_call(msg, endpoint, transport,
- cb, user_data, destroy);
+ cb, user_data, destroy,
+ A2DP_REQUEST_TIMEOUT_MSEC);
}
#endif
@@ -1093,7 +1098,7 @@ static int pac_select(struct bt_bap_pac *lpac, struct bt_bap_pac *rpac,
dbus_message_iter_close_container(&iter, &dict);
if (!media_endpoint_async_call(msg, endpoint, NULL, pac_select_cb,
- data, free))
+ data, free, -1))
return -EIO;
return 0;
@@ -1233,6 +1238,7 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
DBusMessage *msg;
DBusMessageIter iter;
const char *path;
+ int timeout_msec;
DBG("endpoint %p stream %p", endpoint, stream);
@@ -1243,9 +1249,11 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
switch (bt_bap_stream_get_type(stream)) {
case BT_BAP_STREAM_TYPE_UCAST:
transport = pac_ucast_config(stream, cfg, endpoint);
+ timeout_msec = BAP_REQUEST_TIMEOUT_MSEC;
break;
case BT_BAP_STREAM_TYPE_BCAST:
transport = pac_bcast_config(stream, cfg, endpoint);
+ timeout_msec = -1;
break;
default:
transport = NULL;
@@ -1279,7 +1287,8 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
g_dbus_get_properties(conn, path, "org.bluez.MediaTransport1", &iter);
if (!media_endpoint_async_call(msg, endpoint, transport,
- pac_config_cb, data, free))
+ pac_config_cb, data, free,
+ timeout_msec))
return -EIO;
return 0;
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ 1/3] shared/rap: fix use of uninitialized value
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
Fix error handling in send_ras_segment_data
---
src/shared/rap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index b554726b0..145da2060 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -1096,7 +1096,6 @@ static void send_ras_segment_data(struct bt_rap *rap,
uint16_t value_max;
const uint16_t header_len = ras_segment_header_size;
uint16_t raw_payload_size;
- bool ok;
if (!rap || !proc)
return;
@@ -1128,6 +1127,7 @@ static void send_ras_segment_data(struct bt_rap *rap,
uint16_t seg_len;
uint8_t *seg;
uint16_t wr = 0;
+ bool ok = true;
if (index > total_len)
index = total_len;
@@ -1180,7 +1180,7 @@ static void send_ras_segment_data(struct bt_rap *rap,
wr, bt_rap_get_att(rap));
/* Try sending to on-demand characteristic */
- if (ras->ondemand_chrc)
+ if (ras->ondemand_chrc && ok)
ok = gatt_db_attribute_notify(ras->ondemand_chrc, seg,
wr, bt_rap_get_att(rap));
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ 2/3] sdp: Fix integer overflow in sdp_extract_seqtype
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>
Check uint32_t value does not overflow int range.
Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/
---
lib/bluetooth/sdp.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 7210ce0b4..8c0865398 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -1214,6 +1214,7 @@ int sdp_extract_seqtype(const uint8_t *buf, int bufsize, uint8_t *dtdp, int *siz
{
uint8_t dtd;
int scanned = sizeof(uint8_t);
+ uint32_t val32;
if (bufsize < (int) sizeof(uint8_t)) {
SDPERR("Unexpected end of packet");
@@ -1249,7 +1250,12 @@ int sdp_extract_seqtype(const uint8_t *buf, int bufsize, uint8_t *dtdp, int *siz
SDPERR("Unexpected end of packet");
return 0;
}
- *size = bt_get_be32(buf);
+ val32 = bt_get_be32(buf);
+ if (val32 > INT_MAX) {
+ SDPERR("Invalid size");
+ return 0;
+ }
+ *size = val32;
scanned += sizeof(uint32_t);
break;
default:
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ 3/3] main.conf: fix unintentionally set value
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>
Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.
Restore the value back.
---
src/main.conf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/main.conf b/src/main.conf
index 39584e225..5846ef92d 100644
--- a/src/main.conf
+++ b/src/main.conf
@@ -289,7 +289,7 @@
# Export claimed services by plugins
# Possible values: no, read-only, read-write
# Default: read-only
-ExportClaimedServices = read-write
+#ExportClaimedServices = read-only
# Security level:
# Sets security level of ATT channel, setting security anything other than
--
2.54.0
^ permalink raw reply related
* [bluez/bluez] 81a4df: build: Fix inclusion of local_node.json and prov_d...
From: Marcel Holtmann @ 2026-05-17 10:39 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: 81a4df3e88d7b347244195d05c478d7119c242e2
https://github.com/bluez/bluez/commit/81a4df3e88d7b347244195d05c478d7119c242e2
Author: Marcel Holtmann <marcel@holtmann.org>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M Makefile.tools
Log Message:
-----------
build: Fix inclusion of local_node.json and prov_db.json
Commit: 45e66b1c4aed688e1959d38dbb9834d248d12c2d
https://github.com/bluez/bluez/commit/45e66b1c4aed688e1959d38dbb9834d248d12c2d
Author: Marcel Holtmann <marcel@holtmann.org>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M .gitignore
Log Message:
-----------
build: Include test-util binary to ignore list
Compare: https://github.com/bluez/bluez/compare/4f4dba4a7863...45e66b1c4aed
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 59e580: media: use custom DBus timeouts only when remote s...
From: Pauli Virtanen @ 2026-05-17 10:40 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1096011
Home: https://github.com/bluez/bluez
Commit: 59e580a3a123be492d9a3361a367a72566bddb8b
https://github.com/bluez/bluez/commit/59e580a3a123be492d9a3361a367a72566bddb8b
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M profiles/audio/media.c
Log Message:
-----------
media: use custom DBus timeouts only when remote side is waiting
Under high system load (VM instance on boot) it's observed the 3 sec
timeout BlueZ uses for BAP broadcast SetConfiguration may be missed by
Wireplumber, as these are set up immediately on startup together with
any other setup (eg ALSA) that may need time.
There's no actual need for using a short custom timeout in BlueZ for
this, as in this case there is no remote side that is waiting for a reply.
Fix by limiting custom timeouts to cases where there is a waiting
remote. A2DP-specific timeout should be used only for A2DP
SetConfiguration. Similarly, using timeout for BAP only makes sense for
unicast, and should derive from the ATT timeout.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 37aa6d: shared/rap: fix use of uninitialized value
From: Pauli Virtanen @ 2026-05-17 10:40 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1096012
Home: https://github.com/bluez/bluez
Commit: 37aa6da047764ef9b07542002bda84ac551a92d6
https://github.com/bluez/bluez/commit/37aa6da047764ef9b07542002bda84ac551a92d6
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M src/shared/rap.c
Log Message:
-----------
shared/rap: fix use of uninitialized value
Fix error handling in send_ras_segment_data
Commit: 688a13363b7ddcf8c4bf7039cd2270f60ec7b18f
https://github.com/bluez/bluez/commit/688a13363b7ddcf8c4bf7039cd2270f60ec7b18f
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M lib/bluetooth/sdp.c
Log Message:
-----------
sdp: Fix integer overflow in sdp_extract_seqtype
Check uint32_t value does not overflow int range.
Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/
Commit: a023198770010606a847fb1a49afb97ad7c1ed9b
https://github.com/bluez/bluez/commit/a023198770010606a847fb1a49afb97ad7c1ed9b
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-17 (Sun, 17 May 2026)
Changed paths:
M src/main.conf
Log Message:
-----------
main.conf: fix unintentionally set value
Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.
Restore the value back.
Compare: https://github.com/bluez/bluez/compare/37aa6da04776%5E...a02319877001
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* RE: [BlueZ,1/3] shared/rap: fix use of uninitialized value
From: bluez.test.bot @ 2026-05-17 11:33 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 3156 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1096012
---Test result---
Test Summary:
CheckPatch FAIL 1.44 seconds
GitLint FAIL 1.04 seconds
BuildEll PASS 20.18 seconds
BluezMake PASS 606.71 seconds
MakeCheck PASS 1.05 seconds
MakeDistcheck FAIL 219.28 seconds
CheckValgrind PASS 203.90 seconds
CheckSmatch PASS 326.52 seconds
bluezmakeextell PASS 166.47 seconds
IncrementalBuild PASS 628.84 seconds
ScanBuild PASS 974.54 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,3/3] main.conf: fix unintentionally set value
ERROR:GIT_COMMIT_ID: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'Commit 31e4fb1498f4 ("monitor: Add decoding support for HIDS 1.1 flags and attributes")'
#88:
Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.
/github/workspace/src/patch/14577223.patch total: 1 errors, 0 warnings, 8 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14577223.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,2/3] sdp: Fix integer overflow in sdp_extract_seqtype
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
5: B1 Line exceeds max length (171>80): "Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/"
##############################
Test: MakeDistcheck - FAIL
Desc: Run Bluez Make Distcheck
Output:
make[4]: *** [Makefile:10239: test-suite.log] Error 1
make[3]: *** [Makefile:10347: check-TESTS] Error 2
make[2]: *** [Makefile:10818: check-am] Error 2
make[1]: *** [Makefile:10820: check] Error 2
make: *** [Makefile:10741: distcheck] Error 1
https://github.com/bluez/bluez/pull/2130
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ] media: use custom DBus timeouts only when remote side is waiting
From: bluez.test.bot @ 2026-05-17 11:37 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <60b9da865b9beb482f914818c31866ebb00960f7.1779011736.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 1339 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1096011
---Test result---
Test Summary:
CheckPatch PASS 0.32 seconds
GitLint PASS 0.20 seconds
BuildEll PASS 20.21 seconds
BluezMake PASS 660.37 seconds
MakeCheck PASS 3.56 seconds
MakeDistcheck FAIL 230.19 seconds
CheckValgrind PASS 225.47 seconds
CheckSmatch PASS 351.66 seconds
bluezmakeextell PASS 182.49 seconds
IncrementalBuild PASS 670.58 seconds
ScanBuild PASS 1032.73 seconds
Details
##############################
Test: MakeDistcheck - FAIL
Desc: Run Bluez Make Distcheck
Output:
make[4]: *** [Makefile:10239: test-suite.log] Error 1
make[3]: *** [Makefile:10347: check-TESTS] Error 2
make[2]: *** [Makefile:10818: check-am] Error 2
make[1]: *** [Makefile:10820: check] Error 2
make: *** [Makefile:10741: distcheck] Error 1
https://github.com/bluez/bluez/pull/2129
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: SMP: add missing skb len check in smp_cmd_keypress_notify
From: Muhammad Bilal @ 2026-05-17 14:54 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel
Cc: marcel, luiz.dentz, johan.hedberg, stable, Muhammad Bilal
smp_cmd_keypress_notify() accesses the received payload as
struct smp_cmd_keypress_notify without verifying that skb->len
contains enough data.
smp_sig_channel() removes the opcode byte before dispatching to
command handlers, so a SMP_CMD_KEYPRESS_NOTIFY packet without a
payload leaves skb->len equal to zero on entry to the handler,
causing a 1-byte out-of-bounds read from the heap.
Add a length check before accessing the payload and return
SMP_INVALID_PARAMS when the packet is too short, matching the
pattern used by other SMP command handlers.
Fixes: 1408bb6efb04 ("Bluetooth: Add dummy handler for LE SC keypress notification")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
net/bluetooth/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 98f1da4f5..4c98e2a3a 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2932,6 +2932,9 @@ static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
{
struct smp_cmd_keypress_notify *kp = (void *) skb->data;
+ if (skb->len < sizeof(*kp))
+ return SMP_INVALID_PARAMS;
+
bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
return 0;
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox