From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1 0985/1067] Bluetooth: Remove BT_HS
Date: Tue, 21 Jul 2026 17:26:26 +0200 [thread overview]
Message-ID: <20260721152446.589799862@linuxfoundation.org> (raw)
In-Reply-To: <20260721152424.521567757@linuxfoundation.org>
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit e7b02296fb400ee64822fbdd81a0718449066333 ]
High Speed, Alternate MAC and PHY (AMP) extension, has been removed from
Bluetooth Core specification on 5.3:
https://www.bluetooth.com/blog/new-core-specification-v5-3-feature-enhancements/
Fixes: 244bc377591c ("Bluetooth: Add BT_HS config option")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 6fef032af009 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/hci.h | 1
include/net/bluetooth/l2cap.h | 42 -
net/bluetooth/Kconfig | 8
net/bluetooth/Makefile | 1
net/bluetooth/a2mp.c | 1054 -----------------------------------------
net/bluetooth/a2mp.h | 154 ------
net/bluetooth/amp.c | 590 -----------------------
net/bluetooth/amp.h | 61 --
net/bluetooth/hci_conn.c | 4
net/bluetooth/hci_event.c | 2
net/bluetooth/l2cap_core.c | 1069 ------------------------------------------
net/bluetooth/l2cap_sock.c | 18
net/bluetooth/mgmt.c | 73 --
13 files changed, 20 insertions(+), 3057 deletions(-)
delete mode 100644 net/bluetooth/a2mp.c
delete mode 100644 net/bluetooth/a2mp.h
delete mode 100644 net/bluetooth/amp.c
delete mode 100644 net/bluetooth/amp.h
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -382,7 +382,6 @@ enum {
HCI_LIMITED_PRIVACY,
HCI_RPA_EXPIRED,
HCI_RPA_RESOLVING,
- HCI_HS_ENABLED,
HCI_LE_ENABLED,
HCI_ADVERTISING,
HCI_ADVERTISING_CONNECTABLE,
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -60,8 +60,6 @@
#define L2CAP_WAIT_ACK_POLL_PERIOD msecs_to_jiffies(200)
#define L2CAP_WAIT_ACK_TIMEOUT msecs_to_jiffies(10000)
-#define L2CAP_A2MP_DEFAULT_MTU 670
-
/* L2CAP socket address */
struct sockaddr_l2 {
sa_family_t l2_family;
@@ -110,12 +108,6 @@ struct l2cap_conninfo {
#define L2CAP_ECHO_RSP 0x09
#define L2CAP_INFO_REQ 0x0a
#define L2CAP_INFO_RSP 0x0b
-#define L2CAP_CREATE_CHAN_REQ 0x0c
-#define L2CAP_CREATE_CHAN_RSP 0x0d
-#define L2CAP_MOVE_CHAN_REQ 0x0e
-#define L2CAP_MOVE_CHAN_RSP 0x0f
-#define L2CAP_MOVE_CHAN_CFM 0x10
-#define L2CAP_MOVE_CHAN_CFM_RSP 0x11
#define L2CAP_CONN_PARAM_UPDATE_REQ 0x12
#define L2CAP_CONN_PARAM_UPDATE_RSP 0x13
#define L2CAP_LE_CONN_REQ 0x14
@@ -145,7 +137,6 @@ struct l2cap_conninfo {
/* L2CAP fixed channels */
#define L2CAP_FC_SIG_BREDR 0x02
#define L2CAP_FC_CONNLESS 0x04
-#define L2CAP_FC_A2MP 0x08
#define L2CAP_FC_ATT 0x10
#define L2CAP_FC_SIG_LE 0x20
#define L2CAP_FC_SMP_LE 0x40
@@ -268,7 +259,6 @@ struct l2cap_conn_rsp {
/* channel identifier */
#define L2CAP_CID_SIGNALING 0x0001
#define L2CAP_CID_CONN_LESS 0x0002
-#define L2CAP_CID_A2MP 0x0003
#define L2CAP_CID_ATT 0x0004
#define L2CAP_CID_LE_SIGNALING 0x0005
#define L2CAP_CID_SMP 0x0006
@@ -283,7 +273,6 @@ struct l2cap_conn_rsp {
#define L2CAP_CR_BAD_PSM 0x0002
#define L2CAP_CR_SEC_BLOCK 0x0003
#define L2CAP_CR_NO_MEM 0x0004
-#define L2CAP_CR_BAD_AMP 0x0005
#define L2CAP_CR_INVALID_SCID 0x0006
#define L2CAP_CR_SCID_IN_USE 0x0007
@@ -405,29 +394,6 @@ struct l2cap_info_rsp {
__u8 data[];
} __packed;
-struct l2cap_create_chan_req {
- __le16 psm;
- __le16 scid;
- __u8 amp_id;
-} __packed;
-
-struct l2cap_create_chan_rsp {
- __le16 dcid;
- __le16 scid;
- __le16 result;
- __le16 status;
-} __packed;
-
-struct l2cap_move_chan_req {
- __le16 icid;
- __u8 dest_amp_id;
-} __packed;
-
-struct l2cap_move_chan_rsp {
- __le16 icid;
- __le16 result;
-} __packed;
-
#define L2CAP_MR_SUCCESS 0x0000
#define L2CAP_MR_PEND 0x0001
#define L2CAP_MR_BAD_ID 0x0002
@@ -542,8 +508,6 @@ struct l2cap_seq_list {
struct l2cap_chan {
struct l2cap_conn *conn;
- struct hci_conn *hs_hcon;
- struct hci_chan *hs_hchan;
struct kref kref;
atomic_t nesting;
@@ -597,12 +561,6 @@ struct l2cap_chan {
unsigned long conn_state;
unsigned long flags;
- __u8 remote_amp_id;
- __u8 local_amp_id;
- __u8 move_id;
- __u8 move_state;
- __u8 move_role;
-
__u16 next_tx_seq;
__u16 expected_ack_seq;
__u16 expected_tx_seq;
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -62,14 +62,6 @@ source "net/bluetooth/cmtp/Kconfig"
source "net/bluetooth/hidp/Kconfig"
-config BT_HS
- bool "Bluetooth High Speed (HS) features"
- depends on BT_BREDR
- help
- Bluetooth High Speed includes support for off-loading
- Bluetooth connections via 802.11 (wifi) physical layer
- available with Bluetooth version 3.0 or later.
-
config BT_LE
bool "Bluetooth Low Energy (LE) features"
depends on BT
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -19,7 +19,6 @@ bluetooth-y := af_bluetooth.o hci_core.o
bluetooth-$(CONFIG_BT_BREDR) += sco.o
bluetooth-$(CONFIG_BT_LE) += iso.o
-bluetooth-$(CONFIG_BT_HS) += a2mp.o amp.o
bluetooth-$(CONFIG_BT_LEDS) += leds.o
bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o
bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o
--- a/net/bluetooth/a2mp.c
+++ /dev/null
@@ -1,1054 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- Copyright (c) 2010,2011 Code Aurora Forum. All rights reserved.
- Copyright (c) 2011,2012 Intel Corp.
-
-*/
-
-#include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/hci_core.h>
-#include <net/bluetooth/l2cap.h>
-
-#include "hci_request.h"
-#include "a2mp.h"
-#include "amp.h"
-
-#define A2MP_FEAT_EXT 0x8000
-
-/* Global AMP Manager list */
-static LIST_HEAD(amp_mgr_list);
-static DEFINE_MUTEX(amp_mgr_list_lock);
-
-/* A2MP build & send command helper functions */
-static struct a2mp_cmd *__a2mp_build(u8 code, u8 ident, u16 len, void *data)
-{
- struct a2mp_cmd *cmd;
- int plen;
-
- plen = sizeof(*cmd) + len;
- cmd = kzalloc(plen, GFP_KERNEL);
- if (!cmd)
- return NULL;
-
- cmd->code = code;
- cmd->ident = ident;
- cmd->len = cpu_to_le16(len);
-
- memcpy(cmd->data, data, len);
-
- return cmd;
-}
-
-static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data)
-{
- struct l2cap_chan *chan = mgr->a2mp_chan;
- struct a2mp_cmd *cmd;
- u16 total_len = len + sizeof(*cmd);
- struct kvec iv;
- struct msghdr msg;
-
- cmd = __a2mp_build(code, ident, len, data);
- if (!cmd)
- return;
-
- iv.iov_base = cmd;
- iv.iov_len = total_len;
-
- memset(&msg, 0, sizeof(msg));
-
- iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, total_len);
-
- l2cap_chan_send(chan, &msg, total_len);
-
- kfree(cmd);
-}
-
-static u8 __next_ident(struct amp_mgr *mgr)
-{
- if (++mgr->ident == 0)
- mgr->ident = 1;
-
- return mgr->ident;
-}
-
-static struct amp_mgr *amp_mgr_lookup_by_state(u8 state)
-{
- struct amp_mgr *mgr;
-
- mutex_lock(&_mgr_list_lock);
- list_for_each_entry(mgr, &_mgr_list, list) {
- if (test_and_clear_bit(state, &mgr->state)) {
- amp_mgr_get(mgr);
- mutex_unlock(&_mgr_list_lock);
- return mgr;
- }
- }
- mutex_unlock(&_mgr_list_lock);
-
- return NULL;
-}
-
-/* hci_dev_list shall be locked */
-static void __a2mp_add_cl(struct amp_mgr *mgr, struct a2mp_cl *cl)
-{
- struct hci_dev *hdev;
- int i = 1;
-
- cl[0].id = AMP_ID_BREDR;
- cl[0].type = AMP_TYPE_BREDR;
- cl[0].status = AMP_STATUS_BLUETOOTH_ONLY;
-
- list_for_each_entry(hdev, &hci_dev_list, list) {
- if (hdev->dev_type == HCI_AMP) {
- cl[i].id = hdev->id;
- cl[i].type = hdev->amp_type;
- if (test_bit(HCI_UP, &hdev->flags))
- cl[i].status = hdev->amp_status;
- else
- cl[i].status = AMP_STATUS_POWERED_DOWN;
- i++;
- }
- }
-}
-
-/* Processing A2MP messages */
-static int a2mp_command_rej(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_cmd_rej *rej = (void *) skb->data;
-
- if (le16_to_cpu(hdr->len) < sizeof(*rej))
- return -EINVAL;
-
- BT_DBG("ident %u reason %d", hdr->ident, le16_to_cpu(rej->reason));
-
- skb_pull(skb, sizeof(*rej));
-
- return 0;
-}
-
-static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_discov_req *req = (void *) skb->data;
- u16 len = le16_to_cpu(hdr->len);
- struct a2mp_discov_rsp *rsp;
- u16 ext_feat;
- u8 num_ctrl;
- struct hci_dev *hdev;
-
- if (len < sizeof(*req))
- return -EINVAL;
-
- skb_pull(skb, sizeof(*req));
-
- ext_feat = le16_to_cpu(req->ext_feat);
-
- BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat);
-
- /* check that packet is not broken for now */
- while (ext_feat & A2MP_FEAT_EXT) {
- if (len < sizeof(ext_feat))
- return -EINVAL;
-
- ext_feat = get_unaligned_le16(skb->data);
- BT_DBG("efm 0x%4.4x", ext_feat);
- len -= sizeof(ext_feat);
- skb_pull(skb, sizeof(ext_feat));
- }
-
- read_lock(&hci_dev_list_lock);
-
- /* at minimum the BR/EDR needs to be listed */
- num_ctrl = 1;
-
- list_for_each_entry(hdev, &hci_dev_list, list) {
- if (hdev->dev_type == HCI_AMP)
- num_ctrl++;
- }
-
- len = struct_size(rsp, cl, num_ctrl);
- rsp = kmalloc(len, GFP_ATOMIC);
- if (!rsp) {
- read_unlock(&hci_dev_list_lock);
- return -ENOMEM;
- }
-
- rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
- rsp->ext_feat = 0;
-
- __a2mp_add_cl(mgr, rsp->cl);
-
- read_unlock(&hci_dev_list_lock);
-
- a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp);
-
- kfree(rsp);
- return 0;
-}
-
-static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_discov_rsp *rsp = (void *) skb->data;
- u16 len = le16_to_cpu(hdr->len);
- struct a2mp_cl *cl;
- u16 ext_feat;
- bool found = false;
-
- if (len < sizeof(*rsp))
- return -EINVAL;
-
- len -= sizeof(*rsp);
- skb_pull(skb, sizeof(*rsp));
-
- ext_feat = le16_to_cpu(rsp->ext_feat);
-
- BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(rsp->mtu), ext_feat);
-
- /* check that packet is not broken for now */
- while (ext_feat & A2MP_FEAT_EXT) {
- if (len < sizeof(ext_feat))
- return -EINVAL;
-
- ext_feat = get_unaligned_le16(skb->data);
- BT_DBG("efm 0x%4.4x", ext_feat);
- len -= sizeof(ext_feat);
- skb_pull(skb, sizeof(ext_feat));
- }
-
- cl = (void *) skb->data;
- while (len >= sizeof(*cl)) {
- BT_DBG("Remote AMP id %u type %u status %u", cl->id, cl->type,
- cl->status);
-
- if (cl->id != AMP_ID_BREDR && cl->type != AMP_TYPE_BREDR) {
- struct a2mp_info_req req;
-
- found = true;
-
- memset(&req, 0, sizeof(req));
-
- req.id = cl->id;
- a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr),
- sizeof(req), &req);
- }
-
- len -= sizeof(*cl);
- cl = skb_pull(skb, sizeof(*cl));
- }
-
- /* Fall back to L2CAP init sequence */
- if (!found) {
- struct l2cap_conn *conn = mgr->l2cap_conn;
- struct l2cap_chan *chan;
-
- mutex_lock(&conn->chan_lock);
-
- list_for_each_entry(chan, &conn->chan_l, list) {
-
- BT_DBG("chan %p state %s", chan,
- state_to_string(chan->state));
-
- if (chan->scid == L2CAP_CID_A2MP)
- continue;
-
- l2cap_chan_lock(chan);
-
- if (chan->state == BT_CONNECT)
- l2cap_send_conn_req(chan);
-
- l2cap_chan_unlock(chan);
- }
-
- mutex_unlock(&conn->chan_lock);
- }
-
- return 0;
-}
-
-static int a2mp_change_notify(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_cl *cl = (void *) skb->data;
-
- while (skb->len >= sizeof(*cl)) {
- BT_DBG("Controller id %u type %u status %u", cl->id, cl->type,
- cl->status);
- cl = skb_pull(skb, sizeof(*cl));
- }
-
- /* TODO send A2MP_CHANGE_RSP */
-
- return 0;
-}
-
-static void read_local_amp_info_complete(struct hci_dev *hdev, u8 status,
- u16 opcode)
-{
- BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
- a2mp_send_getinfo_rsp(hdev);
-}
-
-static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_info_req *req = (void *) skb->data;
- struct hci_dev *hdev;
- struct hci_request hreq;
- int err = 0;
-
- if (le16_to_cpu(hdr->len) < sizeof(*req))
- return -EINVAL;
-
- BT_DBG("id %u", req->id);
-
- hdev = hci_dev_get(req->id);
- if (!hdev || hdev->dev_type != HCI_AMP) {
- struct a2mp_info_rsp rsp;
-
- memset(&rsp, 0, sizeof(rsp));
-
- rsp.id = req->id;
- rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
-
- a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp),
- &rsp);
-
- goto done;
- }
-
- set_bit(READ_LOC_AMP_INFO, &mgr->state);
- hci_req_init(&hreq, hdev);
- hci_req_add(&hreq, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
- err = hci_req_run(&hreq, read_local_amp_info_complete);
- if (err < 0)
- a2mp_send_getinfo_rsp(hdev);
-
-done:
- if (hdev)
- hci_dev_put(hdev);
-
- skb_pull(skb, sizeof(*req));
- return 0;
-}
-
-static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_info_rsp *rsp = (struct a2mp_info_rsp *) skb->data;
- struct a2mp_amp_assoc_req req;
- struct amp_ctrl *ctrl;
-
- if (le16_to_cpu(hdr->len) < sizeof(*rsp))
- return -EINVAL;
-
- BT_DBG("id %u status 0x%2.2x", rsp->id, rsp->status);
-
- if (rsp->status)
- return -EINVAL;
-
- ctrl = amp_ctrl_add(mgr, rsp->id);
- if (!ctrl)
- return -ENOMEM;
-
- memset(&req, 0, sizeof(req));
-
- req.id = rsp->id;
- a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req),
- &req);
-
- skb_pull(skb, sizeof(*rsp));
- return 0;
-}
-
-static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_amp_assoc_req *req = (void *) skb->data;
- struct hci_dev *hdev;
- struct amp_mgr *tmp;
-
- if (le16_to_cpu(hdr->len) < sizeof(*req))
- return -EINVAL;
-
- BT_DBG("id %u", req->id);
-
- /* Make sure that other request is not processed */
- tmp = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC);
-
- hdev = hci_dev_get(req->id);
- if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
- struct a2mp_amp_assoc_rsp rsp;
-
- memset(&rsp, 0, sizeof(rsp));
- rsp.id = req->id;
-
- if (tmp) {
- rsp.status = A2MP_STATUS_COLLISION_OCCURED;
- amp_mgr_put(tmp);
- } else {
- rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
- }
-
- a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, hdr->ident, sizeof(rsp),
- &rsp);
-
- goto done;
- }
-
- amp_read_loc_assoc(hdev, mgr);
-
-done:
- if (hdev)
- hci_dev_put(hdev);
-
- skb_pull(skb, sizeof(*req));
- return 0;
-}
-
-static int a2mp_getampassoc_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_amp_assoc_rsp *rsp = (void *) skb->data;
- u16 len = le16_to_cpu(hdr->len);
- struct hci_dev *hdev;
- struct amp_ctrl *ctrl;
- struct hci_conn *hcon;
- size_t assoc_len;
-
- if (len < sizeof(*rsp))
- return -EINVAL;
-
- assoc_len = len - sizeof(*rsp);
-
- BT_DBG("id %u status 0x%2.2x assoc len %zu", rsp->id, rsp->status,
- assoc_len);
-
- if (rsp->status)
- return -EINVAL;
-
- /* Save remote ASSOC data */
- ctrl = amp_ctrl_lookup(mgr, rsp->id);
- if (ctrl) {
- u8 *assoc;
-
- assoc = kmemdup(rsp->amp_assoc, assoc_len, GFP_KERNEL);
- if (!assoc) {
- amp_ctrl_put(ctrl);
- return -ENOMEM;
- }
-
- ctrl->assoc = assoc;
- ctrl->assoc_len = assoc_len;
- ctrl->assoc_rem_len = assoc_len;
- ctrl->assoc_len_so_far = 0;
-
- amp_ctrl_put(ctrl);
- }
-
- /* Create Phys Link */
- hdev = hci_dev_get(rsp->id);
- if (!hdev)
- return -EINVAL;
-
- hcon = phylink_add(hdev, mgr, rsp->id, true);
- if (!hcon)
- goto done;
-
- BT_DBG("Created hcon %p: loc:%u -> rem:%u", hcon, hdev->id, rsp->id);
-
- mgr->bredr_chan->remote_amp_id = rsp->id;
-
- amp_create_phylink(hdev, mgr, hcon);
-
-done:
- hci_dev_put(hdev);
- skb_pull(skb, len);
- return 0;
-}
-
-static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_physlink_req *req = (void *) skb->data;
- struct a2mp_physlink_rsp rsp;
- struct hci_dev *hdev;
- struct hci_conn *hcon;
- struct amp_ctrl *ctrl;
-
- if (le16_to_cpu(hdr->len) < sizeof(*req))
- return -EINVAL;
-
- BT_DBG("local_id %u, remote_id %u", req->local_id, req->remote_id);
-
- memset(&rsp, 0, sizeof(rsp));
-
- rsp.local_id = req->remote_id;
- rsp.remote_id = req->local_id;
-
- hdev = hci_dev_get(req->remote_id);
- if (!hdev || hdev->amp_type == AMP_TYPE_BREDR) {
- rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
- goto send_rsp;
- }
-
- ctrl = amp_ctrl_lookup(mgr, rsp.remote_id);
- if (!ctrl) {
- ctrl = amp_ctrl_add(mgr, rsp.remote_id);
- if (ctrl) {
- amp_ctrl_get(ctrl);
- } else {
- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
- goto send_rsp;
- }
- }
-
- if (ctrl) {
- size_t assoc_len = le16_to_cpu(hdr->len) - sizeof(*req);
- u8 *assoc;
-
- assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
- if (!assoc) {
- amp_ctrl_put(ctrl);
- hci_dev_put(hdev);
- return -ENOMEM;
- }
-
- ctrl->assoc = assoc;
- ctrl->assoc_len = assoc_len;
- ctrl->assoc_rem_len = assoc_len;
- ctrl->assoc_len_so_far = 0;
-
- amp_ctrl_put(ctrl);
- }
-
- hcon = phylink_add(hdev, mgr, req->local_id, false);
- if (hcon) {
- amp_accept_phylink(hdev, mgr, hcon);
- rsp.status = A2MP_STATUS_SUCCESS;
- } else {
- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
- }
-
-send_rsp:
- if (hdev)
- hci_dev_put(hdev);
-
- /* Reply error now and success after HCI Write Remote AMP Assoc
- command complete with success status
- */
- if (rsp.status != A2MP_STATUS_SUCCESS) {
- a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident,
- sizeof(rsp), &rsp);
- } else {
- set_bit(WRITE_REMOTE_AMP_ASSOC, &mgr->state);
- mgr->ident = hdr->ident;
- }
-
- skb_pull(skb, le16_to_cpu(hdr->len));
- return 0;
-}
-
-static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- struct a2mp_physlink_req *req = (void *) skb->data;
- struct a2mp_physlink_rsp rsp;
- struct hci_dev *hdev;
- struct hci_conn *hcon;
-
- if (le16_to_cpu(hdr->len) < sizeof(*req))
- return -EINVAL;
-
- BT_DBG("local_id %u remote_id %u", req->local_id, req->remote_id);
-
- memset(&rsp, 0, sizeof(rsp));
-
- rsp.local_id = req->remote_id;
- rsp.remote_id = req->local_id;
- rsp.status = A2MP_STATUS_SUCCESS;
-
- hdev = hci_dev_get(req->remote_id);
- if (!hdev) {
- rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
- goto send_rsp;
- }
-
- hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
- &mgr->l2cap_conn->hcon->dst);
- if (!hcon) {
- bt_dev_err(hdev, "no phys link exist");
- rsp.status = A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS;
- goto clean;
- }
-
- /* TODO Disconnect Phys Link here */
-
-clean:
- hci_dev_put(hdev);
-
-send_rsp:
- a2mp_send(mgr, A2MP_DISCONNPHYSLINK_RSP, hdr->ident, sizeof(rsp), &rsp);
-
- skb_pull(skb, sizeof(*req));
- return 0;
-}
-
-static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- struct a2mp_cmd *hdr)
-{
- BT_DBG("ident %u code 0x%2.2x", hdr->ident, hdr->code);
-
- skb_pull(skb, le16_to_cpu(hdr->len));
- return 0;
-}
-
-/* Handle A2MP signalling */
-static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
-{
- struct a2mp_cmd *hdr;
- struct amp_mgr *mgr = chan->data;
- int err = 0;
-
- amp_mgr_get(mgr);
-
- while (skb->len >= sizeof(*hdr)) {
- u16 len;
-
- hdr = (void *) skb->data;
- len = le16_to_cpu(hdr->len);
-
- BT_DBG("code 0x%2.2x id %u len %u", hdr->code, hdr->ident, len);
-
- skb_pull(skb, sizeof(*hdr));
-
- if (len > skb->len || !hdr->ident) {
- err = -EINVAL;
- break;
- }
-
- mgr->ident = hdr->ident;
-
- switch (hdr->code) {
- case A2MP_COMMAND_REJ:
- a2mp_command_rej(mgr, skb, hdr);
- break;
-
- case A2MP_DISCOVER_REQ:
- err = a2mp_discover_req(mgr, skb, hdr);
- break;
-
- case A2MP_CHANGE_NOTIFY:
- err = a2mp_change_notify(mgr, skb, hdr);
- break;
-
- case A2MP_GETINFO_REQ:
- err = a2mp_getinfo_req(mgr, skb, hdr);
- break;
-
- case A2MP_GETAMPASSOC_REQ:
- err = a2mp_getampassoc_req(mgr, skb, hdr);
- break;
-
- case A2MP_CREATEPHYSLINK_REQ:
- err = a2mp_createphyslink_req(mgr, skb, hdr);
- break;
-
- case A2MP_DISCONNPHYSLINK_REQ:
- err = a2mp_discphyslink_req(mgr, skb, hdr);
- break;
-
- case A2MP_DISCOVER_RSP:
- err = a2mp_discover_rsp(mgr, skb, hdr);
- break;
-
- case A2MP_GETINFO_RSP:
- err = a2mp_getinfo_rsp(mgr, skb, hdr);
- break;
-
- case A2MP_GETAMPASSOC_RSP:
- err = a2mp_getampassoc_rsp(mgr, skb, hdr);
- break;
-
- case A2MP_CHANGE_RSP:
- case A2MP_CREATEPHYSLINK_RSP:
- case A2MP_DISCONNPHYSLINK_RSP:
- err = a2mp_cmd_rsp(mgr, skb, hdr);
- break;
-
- default:
- BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code);
- err = -EINVAL;
- break;
- }
- }
-
- if (err) {
- struct a2mp_cmd_rej rej;
-
- memset(&rej, 0, sizeof(rej));
-
- rej.reason = cpu_to_le16(0);
- hdr = (void *) skb->data;
-
- BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
-
- a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej),
- &rej);
- }
-
- /* Always free skb and return success error code to prevent
- from sending L2CAP Disconnect over A2MP channel */
- kfree_skb(skb);
-
- amp_mgr_put(mgr);
-
- return 0;
-}
-
-static void a2mp_chan_close_cb(struct l2cap_chan *chan)
-{
- l2cap_chan_put(chan);
-}
-
-static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state,
- int err)
-{
- struct amp_mgr *mgr = chan->data;
-
- if (!mgr)
- return;
-
- BT_DBG("chan %p state %s", chan, state_to_string(state));
-
- chan->state = state;
-
- switch (state) {
- case BT_CLOSED:
- if (mgr)
- amp_mgr_put(mgr);
- break;
- }
-}
-
-static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
- unsigned long hdr_len,
- unsigned long len, int nb)
-{
- struct sk_buff *skb;
-
- skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
- if (!skb)
- return ERR_PTR(-ENOMEM);
-
- return skb;
-}
-
-static const struct l2cap_ops a2mp_chan_ops = {
- .name = "L2CAP A2MP channel",
- .recv = a2mp_chan_recv_cb,
- .close = a2mp_chan_close_cb,
- .state_change = a2mp_chan_state_change_cb,
- .alloc_skb = a2mp_chan_alloc_skb_cb,
-
- /* Not implemented for A2MP */
- .new_connection = l2cap_chan_no_new_connection,
- .teardown = l2cap_chan_no_teardown,
- .ready = l2cap_chan_no_ready,
- .defer = l2cap_chan_no_defer,
- .resume = l2cap_chan_no_resume,
- .set_shutdown = l2cap_chan_no_set_shutdown,
- .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
-};
-
-static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn, bool locked)
-{
- struct l2cap_chan *chan;
- int err;
-
- chan = l2cap_chan_create();
- if (!chan)
- return NULL;
-
- BT_DBG("chan %p", chan);
-
- chan->chan_type = L2CAP_CHAN_FIXED;
- chan->scid = L2CAP_CID_A2MP;
- chan->dcid = L2CAP_CID_A2MP;
- chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
- chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
- chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
-
- chan->ops = &a2mp_chan_ops;
-
- l2cap_chan_set_defaults(chan);
- chan->remote_max_tx = chan->max_tx;
- chan->remote_tx_win = chan->tx_win;
-
- chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
- chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
-
- skb_queue_head_init(&chan->tx_q);
-
- chan->mode = L2CAP_MODE_ERTM;
-
- err = l2cap_ertm_init(chan);
- if (err < 0) {
- l2cap_chan_del(chan, 0);
- return NULL;
- }
-
- chan->conf_state = 0;
-
- if (locked)
- __l2cap_chan_add(conn, chan);
- else
- l2cap_chan_add(conn, chan);
-
- chan->remote_mps = chan->omtu;
- chan->mps = chan->omtu;
-
- chan->state = BT_CONNECTED;
-
- return chan;
-}
-
-/* AMP Manager functions */
-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr)
-{
- BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref));
-
- kref_get(&mgr->kref);
-
- return mgr;
-}
-
-static void amp_mgr_destroy(struct kref *kref)
-{
- struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref);
-
- BT_DBG("mgr %p", mgr);
-
- mutex_lock(&_mgr_list_lock);
- list_del(&mgr->list);
- mutex_unlock(&_mgr_list_lock);
-
- amp_ctrl_list_flush(mgr);
- kfree(mgr);
-}
-
-int amp_mgr_put(struct amp_mgr *mgr)
-{
- BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref));
-
- return kref_put(&mgr->kref, &_mgr_destroy);
-}
-
-static struct amp_mgr *amp_mgr_create(struct l2cap_conn *conn, bool locked)
-{
- struct amp_mgr *mgr;
- struct l2cap_chan *chan;
-
- mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
- if (!mgr)
- return NULL;
-
- BT_DBG("conn %p mgr %p", conn, mgr);
-
- mgr->l2cap_conn = conn;
-
- chan = a2mp_chan_open(conn, locked);
- if (!chan) {
- kfree(mgr);
- return NULL;
- }
-
- mgr->a2mp_chan = chan;
- chan->data = mgr;
-
- conn->hcon->amp_mgr = mgr;
-
- kref_init(&mgr->kref);
-
- /* Remote AMP ctrl list initialization */
- INIT_LIST_HEAD(&mgr->amp_ctrls);
- mutex_init(&mgr->amp_ctrls_lock);
-
- mutex_lock(&_mgr_list_lock);
- list_add(&mgr->list, &_mgr_list);
- mutex_unlock(&_mgr_list_lock);
-
- return mgr;
-}
-
-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
- struct sk_buff *skb)
-{
- struct amp_mgr *mgr;
-
- if (conn->hcon->type != ACL_LINK)
- return NULL;
-
- mgr = amp_mgr_create(conn, false);
- if (!mgr) {
- BT_ERR("Could not create AMP manager");
- return NULL;
- }
-
- BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan);
-
- return mgr->a2mp_chan;
-}
-
-void a2mp_send_getinfo_rsp(struct hci_dev *hdev)
-{
- struct amp_mgr *mgr;
- struct a2mp_info_rsp rsp;
-
- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_INFO);
- if (!mgr)
- return;
-
- BT_DBG("%s mgr %p", hdev->name, mgr);
-
- memset(&rsp, 0, sizeof(rsp));
-
- rsp.id = hdev->id;
- rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
-
- if (hdev->amp_type != AMP_TYPE_BREDR) {
- rsp.status = 0;
- rsp.total_bw = cpu_to_le32(hdev->amp_total_bw);
- rsp.max_bw = cpu_to_le32(hdev->amp_max_bw);
- rsp.min_latency = cpu_to_le32(hdev->amp_min_latency);
- rsp.pal_cap = cpu_to_le16(hdev->amp_pal_cap);
- rsp.assoc_size = cpu_to_le16(hdev->amp_assoc_size);
- }
-
- a2mp_send(mgr, A2MP_GETINFO_RSP, mgr->ident, sizeof(rsp), &rsp);
- amp_mgr_put(mgr);
-}
-
-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status)
-{
- struct amp_mgr *mgr;
- struct amp_assoc *loc_assoc = &hdev->loc_assoc;
- struct a2mp_amp_assoc_rsp *rsp;
- size_t len;
-
- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC);
- if (!mgr)
- return;
-
- BT_DBG("%s mgr %p", hdev->name, mgr);
-
- len = sizeof(struct a2mp_amp_assoc_rsp) + loc_assoc->len;
- rsp = kzalloc(len, GFP_KERNEL);
- if (!rsp) {
- amp_mgr_put(mgr);
- return;
- }
-
- rsp->id = hdev->id;
-
- if (status) {
- rsp->status = A2MP_STATUS_INVALID_CTRL_ID;
- } else {
- rsp->status = A2MP_STATUS_SUCCESS;
- memcpy(rsp->amp_assoc, loc_assoc->data, loc_assoc->len);
- }
-
- a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, mgr->ident, len, rsp);
- amp_mgr_put(mgr);
- kfree(rsp);
-}
-
-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status)
-{
- struct amp_mgr *mgr;
- struct amp_assoc *loc_assoc = &hdev->loc_assoc;
- struct a2mp_physlink_req *req;
- struct l2cap_chan *bredr_chan;
- size_t len;
-
- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC_FINAL);
- if (!mgr)
- return;
-
- len = sizeof(*req) + loc_assoc->len;
-
- BT_DBG("%s mgr %p assoc_len %zu", hdev->name, mgr, len);
-
- req = kzalloc(len, GFP_KERNEL);
- if (!req) {
- amp_mgr_put(mgr);
- return;
- }
-
- bredr_chan = mgr->bredr_chan;
- if (!bredr_chan)
- goto clean;
-
- req->local_id = hdev->id;
- req->remote_id = bredr_chan->remote_amp_id;
- memcpy(req->amp_assoc, loc_assoc->data, loc_assoc->len);
-
- a2mp_send(mgr, A2MP_CREATEPHYSLINK_REQ, __next_ident(mgr), len, req);
-
-clean:
- amp_mgr_put(mgr);
- kfree(req);
-}
-
-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
-{
- struct amp_mgr *mgr;
- struct a2mp_physlink_rsp rsp;
- struct hci_conn *hs_hcon;
-
- mgr = amp_mgr_lookup_by_state(WRITE_REMOTE_AMP_ASSOC);
- if (!mgr)
- return;
-
- memset(&rsp, 0, sizeof(rsp));
-
- hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
- if (!hs_hcon) {
- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
- } else {
- rsp.remote_id = hs_hcon->remote_id;
- rsp.status = A2MP_STATUS_SUCCESS;
- }
-
- BT_DBG("%s mgr %p hs_hcon %p status %u", hdev->name, mgr, hs_hcon,
- status);
-
- rsp.local_id = hdev->id;
- a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, mgr->ident, sizeof(rsp), &rsp);
- amp_mgr_put(mgr);
-}
-
-void a2mp_discover_amp(struct l2cap_chan *chan)
-{
- struct l2cap_conn *conn = chan->conn;
- struct amp_mgr *mgr = conn->hcon->amp_mgr;
- struct a2mp_discov_req req;
-
- BT_DBG("chan %p conn %p mgr %p", chan, conn, mgr);
-
- if (!mgr) {
- mgr = amp_mgr_create(conn, true);
- if (!mgr)
- return;
- }
-
- mgr->bredr_chan = chan;
-
- memset(&req, 0, sizeof(req));
-
- req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
- req.ext_feat = 0;
- a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req);
-}
--- a/net/bluetooth/a2mp.h
+++ /dev/null
@@ -1,154 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- Copyright (c) 2010,2011 Code Aurora Forum. All rights reserved.
- Copyright (c) 2011,2012 Intel Corp.
-
-*/
-
-#ifndef __A2MP_H
-#define __A2MP_H
-
-#include <net/bluetooth/l2cap.h>
-
-enum amp_mgr_state {
- READ_LOC_AMP_INFO,
- READ_LOC_AMP_ASSOC,
- READ_LOC_AMP_ASSOC_FINAL,
- WRITE_REMOTE_AMP_ASSOC,
-};
-
-struct amp_mgr {
- struct list_head list;
- struct l2cap_conn *l2cap_conn;
- struct l2cap_chan *a2mp_chan;
- struct l2cap_chan *bredr_chan;
- struct kref kref;
- __u8 ident;
- __u8 handle;
- unsigned long state;
- unsigned long flags;
-
- struct list_head amp_ctrls;
- struct mutex amp_ctrls_lock;
-};
-
-struct a2mp_cmd {
- __u8 code;
- __u8 ident;
- __le16 len;
- __u8 data[];
-} __packed;
-
-/* A2MP command codes */
-#define A2MP_COMMAND_REJ 0x01
-struct a2mp_cmd_rej {
- __le16 reason;
- __u8 data[];
-} __packed;
-
-#define A2MP_DISCOVER_REQ 0x02
-struct a2mp_discov_req {
- __le16 mtu;
- __le16 ext_feat;
-} __packed;
-
-struct a2mp_cl {
- __u8 id;
- __u8 type;
- __u8 status;
-} __packed;
-
-#define A2MP_DISCOVER_RSP 0x03
-struct a2mp_discov_rsp {
- __le16 mtu;
- __le16 ext_feat;
- struct a2mp_cl cl[];
-} __packed;
-
-#define A2MP_CHANGE_NOTIFY 0x04
-#define A2MP_CHANGE_RSP 0x05
-
-#define A2MP_GETINFO_REQ 0x06
-struct a2mp_info_req {
- __u8 id;
-} __packed;
-
-#define A2MP_GETINFO_RSP 0x07
-struct a2mp_info_rsp {
- __u8 id;
- __u8 status;
- __le32 total_bw;
- __le32 max_bw;
- __le32 min_latency;
- __le16 pal_cap;
- __le16 assoc_size;
-} __packed;
-
-#define A2MP_GETAMPASSOC_REQ 0x08
-struct a2mp_amp_assoc_req {
- __u8 id;
-} __packed;
-
-#define A2MP_GETAMPASSOC_RSP 0x09
-struct a2mp_amp_assoc_rsp {
- __u8 id;
- __u8 status;
- __u8 amp_assoc[];
-} __packed;
-
-#define A2MP_CREATEPHYSLINK_REQ 0x0A
-#define A2MP_DISCONNPHYSLINK_REQ 0x0C
-struct a2mp_physlink_req {
- __u8 local_id;
- __u8 remote_id;
- __u8 amp_assoc[];
-} __packed;
-
-#define A2MP_CREATEPHYSLINK_RSP 0x0B
-#define A2MP_DISCONNPHYSLINK_RSP 0x0D
-struct a2mp_physlink_rsp {
- __u8 local_id;
- __u8 remote_id;
- __u8 status;
-} __packed;
-
-/* A2MP response status */
-#define A2MP_STATUS_SUCCESS 0x00
-#define A2MP_STATUS_INVALID_CTRL_ID 0x01
-#define A2MP_STATUS_UNABLE_START_LINK_CREATION 0x02
-#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS 0x02
-#define A2MP_STATUS_COLLISION_OCCURED 0x03
-#define A2MP_STATUS_DISCONN_REQ_RECVD 0x04
-#define A2MP_STATUS_PHYS_LINK_EXISTS 0x05
-#define A2MP_STATUS_SECURITY_VIOLATION 0x06
-
-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr);
-
-#if IS_ENABLED(CONFIG_BT_HS)
-int amp_mgr_put(struct amp_mgr *mgr);
-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
- struct sk_buff *skb);
-void a2mp_discover_amp(struct l2cap_chan *chan);
-#else
-static inline int amp_mgr_put(struct amp_mgr *mgr)
-{
- return 0;
-}
-
-static inline struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
- struct sk_buff *skb)
-{
- return NULL;
-}
-
-static inline void a2mp_discover_amp(struct l2cap_chan *chan)
-{
-}
-#endif
-
-void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status);
-
-#endif /* __A2MP_H */
--- a/net/bluetooth/amp.c
+++ /dev/null
@@ -1,590 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- Copyright (c) 2011,2012 Intel Corp.
-
-*/
-
-#include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/hci.h>
-#include <net/bluetooth/hci_core.h>
-#include <crypto/hash.h>
-
-#include "hci_request.h"
-#include "a2mp.h"
-#include "amp.h"
-
-/* Remote AMP Controllers interface */
-void amp_ctrl_get(struct amp_ctrl *ctrl)
-{
- BT_DBG("ctrl %p orig refcnt %d", ctrl,
- kref_read(&ctrl->kref));
-
- kref_get(&ctrl->kref);
-}
-
-static void amp_ctrl_destroy(struct kref *kref)
-{
- struct amp_ctrl *ctrl = container_of(kref, struct amp_ctrl, kref);
-
- BT_DBG("ctrl %p", ctrl);
-
- kfree(ctrl->assoc);
- kfree(ctrl);
-}
-
-int amp_ctrl_put(struct amp_ctrl *ctrl)
-{
- BT_DBG("ctrl %p orig refcnt %d", ctrl,
- kref_read(&ctrl->kref));
-
- return kref_put(&ctrl->kref, &_ctrl_destroy);
-}
-
-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id)
-{
- struct amp_ctrl *ctrl;
-
- ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL);
- if (!ctrl)
- return NULL;
-
- kref_init(&ctrl->kref);
- ctrl->id = id;
-
- mutex_lock(&mgr->amp_ctrls_lock);
- list_add(&ctrl->list, &mgr->amp_ctrls);
- mutex_unlock(&mgr->amp_ctrls_lock);
-
- BT_DBG("mgr %p ctrl %p", mgr, ctrl);
-
- return ctrl;
-}
-
-void amp_ctrl_list_flush(struct amp_mgr *mgr)
-{
- struct amp_ctrl *ctrl, *n;
-
- BT_DBG("mgr %p", mgr);
-
- mutex_lock(&mgr->amp_ctrls_lock);
- list_for_each_entry_safe(ctrl, n, &mgr->amp_ctrls, list) {
- list_del(&ctrl->list);
- amp_ctrl_put(ctrl);
- }
- mutex_unlock(&mgr->amp_ctrls_lock);
-}
-
-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id)
-{
- struct amp_ctrl *ctrl;
-
- BT_DBG("mgr %p id %u", mgr, id);
-
- mutex_lock(&mgr->amp_ctrls_lock);
- list_for_each_entry(ctrl, &mgr->amp_ctrls, list) {
- if (ctrl->id == id) {
- amp_ctrl_get(ctrl);
- mutex_unlock(&mgr->amp_ctrls_lock);
- return ctrl;
- }
- }
- mutex_unlock(&mgr->amp_ctrls_lock);
-
- return NULL;
-}
-
-/* Physical Link interface */
-static u8 __next_handle(struct amp_mgr *mgr)
-{
- if (++mgr->handle == 0)
- mgr->handle = 1;
-
- return mgr->handle;
-}
-
-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
- u8 remote_id, bool out)
-{
- bdaddr_t *dst = &mgr->l2cap_conn->hcon->dst;
- struct hci_conn *hcon;
- u8 role = out ? HCI_ROLE_MASTER : HCI_ROLE_SLAVE;
-
- hcon = hci_conn_add(hdev, AMP_LINK, dst, role, __next_handle(mgr));
- if (!hcon)
- return NULL;
-
- BT_DBG("hcon %p dst %pMR", hcon, dst);
-
- hcon->state = BT_CONNECT;
- hcon->attempt++;
- hcon->remote_id = remote_id;
- hcon->amp_mgr = amp_mgr_get(mgr);
-
- return hcon;
-}
-
-/* AMP crypto key generation interface */
-static int hmac_sha256(u8 *key, u8 ksize, char *plaintext, u8 psize, u8 *output)
-{
- struct crypto_shash *tfm;
- struct shash_desc *shash;
- int ret;
-
- if (!ksize)
- return -EINVAL;
-
- tfm = crypto_alloc_shash("hmac(sha256)", 0, 0);
- if (IS_ERR(tfm)) {
- BT_DBG("crypto_alloc_ahash failed: err %ld", PTR_ERR(tfm));
- return PTR_ERR(tfm);
- }
-
- ret = crypto_shash_setkey(tfm, key, ksize);
- if (ret) {
- BT_DBG("crypto_ahash_setkey failed: err %d", ret);
- goto failed;
- }
-
- shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(tfm),
- GFP_KERNEL);
- if (!shash) {
- ret = -ENOMEM;
- goto failed;
- }
-
- shash->tfm = tfm;
-
- ret = crypto_shash_digest(shash, plaintext, psize, output);
-
- kfree(shash);
-
-failed:
- crypto_free_shash(tfm);
- return ret;
-}
-
-int phylink_gen_key(struct hci_conn *conn, u8 *data, u8 *len, u8 *type)
-{
- struct hci_dev *hdev = conn->hdev;
- struct link_key *key;
- u8 keybuf[HCI_AMP_LINK_KEY_SIZE];
- u8 gamp_key[HCI_AMP_LINK_KEY_SIZE];
- int err;
-
- if (!hci_conn_check_link_mode(conn))
- return -EACCES;
-
- BT_DBG("conn %p key_type %d", conn, conn->key_type);
-
- /* Legacy key */
- if (conn->key_type < 3) {
- bt_dev_err(hdev, "legacy key type %u", conn->key_type);
- return -EACCES;
- }
-
- *type = conn->key_type;
- *len = HCI_AMP_LINK_KEY_SIZE;
-
- key = hci_find_link_key(hdev, &conn->dst);
- if (!key) {
- BT_DBG("No Link key for conn %p dst %pMR", conn, &conn->dst);
- return -EACCES;
- }
-
- /* BR/EDR Link Key concatenated together with itself */
- memcpy(&keybuf[0], key->val, HCI_LINK_KEY_SIZE);
- memcpy(&keybuf[HCI_LINK_KEY_SIZE], key->val, HCI_LINK_KEY_SIZE);
-
- /* Derive Generic AMP Link Key (gamp) */
- err = hmac_sha256(keybuf, HCI_AMP_LINK_KEY_SIZE, "gamp", 4, gamp_key);
- if (err) {
- bt_dev_err(hdev, "could not derive Generic AMP Key: err %d", err);
- return err;
- }
-
- if (conn->key_type == HCI_LK_DEBUG_COMBINATION) {
- BT_DBG("Use Generic AMP Key (gamp)");
- memcpy(data, gamp_key, HCI_AMP_LINK_KEY_SIZE);
- return err;
- }
-
- /* Derive Dedicated AMP Link Key: "802b" is 802.11 PAL keyID */
- return hmac_sha256(gamp_key, HCI_AMP_LINK_KEY_SIZE, "802b", 4, data);
-}
-
-static void read_local_amp_assoc_complete(struct hci_dev *hdev, u8 status,
- u16 opcode, struct sk_buff *skb)
-{
- struct hci_rp_read_local_amp_assoc *rp = (void *)skb->data;
- struct amp_assoc *assoc = &hdev->loc_assoc;
- size_t rem_len, frag_len;
-
- BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
-
- if (rp->status)
- goto send_rsp;
-
- frag_len = skb->len - sizeof(*rp);
- rem_len = __le16_to_cpu(rp->rem_len);
-
- if (rem_len > frag_len) {
- BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
-
- memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
- assoc->offset += frag_len;
-
- /* Read other fragments */
- amp_read_loc_assoc_frag(hdev, rp->phy_handle);
-
- return;
- }
-
- memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
- assoc->len = assoc->offset + rem_len;
- assoc->offset = 0;
-
-send_rsp:
- /* Send A2MP Rsp when all fragments are received */
- a2mp_send_getampassoc_rsp(hdev, rp->status);
- a2mp_send_create_phy_link_req(hdev, rp->status);
-}
-
-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle)
-{
- struct hci_cp_read_local_amp_assoc cp;
- struct amp_assoc *loc_assoc = &hdev->loc_assoc;
- struct hci_request req;
- int err;
-
- BT_DBG("%s handle %u", hdev->name, phy_handle);
-
- cp.phy_handle = phy_handle;
- cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
- cp.len_so_far = cpu_to_le16(loc_assoc->offset);
-
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
- err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
- if (err < 0)
- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
-}
-
-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr)
-{
- struct hci_cp_read_local_amp_assoc cp;
- struct hci_request req;
- int err;
-
- memset(&hdev->loc_assoc, 0, sizeof(struct amp_assoc));
- memset(&cp, 0, sizeof(cp));
-
- cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
-
- set_bit(READ_LOC_AMP_ASSOC, &mgr->state);
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
- err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
- if (err < 0)
- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
-}
-
-void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
- struct hci_conn *hcon)
-{
- struct hci_cp_read_local_amp_assoc cp;
- struct amp_mgr *mgr = hcon->amp_mgr;
- struct hci_request req;
- int err;
-
- if (!mgr)
- return;
-
- cp.phy_handle = hcon->handle;
- cp.len_so_far = cpu_to_le16(0);
- cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
-
- set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
-
- /* Read Local AMP Assoc final link information data */
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
- err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
- if (err < 0)
- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
-}
-
-static void write_remote_amp_assoc_complete(struct hci_dev *hdev, u8 status,
- u16 opcode, struct sk_buff *skb)
-{
- struct hci_rp_write_remote_amp_assoc *rp = (void *)skb->data;
-
- BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
- hdev->name, rp->status, rp->phy_handle);
-
- if (rp->status)
- return;
-
- amp_write_rem_assoc_continue(hdev, rp->phy_handle);
-}
-
-/* Write AMP Assoc data fragments, returns true with last fragment written*/
-static bool amp_write_rem_assoc_frag(struct hci_dev *hdev,
- struct hci_conn *hcon)
-{
- struct hci_cp_write_remote_amp_assoc *cp;
- struct amp_mgr *mgr = hcon->amp_mgr;
- struct amp_ctrl *ctrl;
- struct hci_request req;
- u16 frag_len, len;
-
- ctrl = amp_ctrl_lookup(mgr, hcon->remote_id);
- if (!ctrl)
- return false;
-
- if (!ctrl->assoc_rem_len) {
- BT_DBG("all fragments are written");
- ctrl->assoc_rem_len = ctrl->assoc_len;
- ctrl->assoc_len_so_far = 0;
-
- amp_ctrl_put(ctrl);
- return true;
- }
-
- frag_len = min_t(u16, 248, ctrl->assoc_rem_len);
- len = frag_len + sizeof(*cp);
-
- cp = kzalloc(len, GFP_KERNEL);
- if (!cp) {
- amp_ctrl_put(ctrl);
- return false;
- }
-
- BT_DBG("hcon %p ctrl %p frag_len %u assoc_len %u rem_len %u",
- hcon, ctrl, frag_len, ctrl->assoc_len, ctrl->assoc_rem_len);
-
- cp->phy_handle = hcon->handle;
- cp->len_so_far = cpu_to_le16(ctrl->assoc_len_so_far);
- cp->rem_len = cpu_to_le16(ctrl->assoc_rem_len);
- memcpy(cp->frag, ctrl->assoc, frag_len);
-
- ctrl->assoc_len_so_far += frag_len;
- ctrl->assoc_rem_len -= frag_len;
-
- amp_ctrl_put(ctrl);
-
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_WRITE_REMOTE_AMP_ASSOC, len, cp);
- hci_req_run_skb(&req, write_remote_amp_assoc_complete);
-
- kfree(cp);
-
- return false;
-}
-
-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle)
-{
- struct hci_conn *hcon;
-
- BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle);
-
- hcon = hci_conn_hash_lookup_handle(hdev, handle);
- if (!hcon)
- return;
-
- /* Send A2MP create phylink rsp when all fragments are written */
- if (amp_write_rem_assoc_frag(hdev, hcon))
- a2mp_send_create_phy_link_rsp(hdev, 0);
-}
-
-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle)
-{
- struct hci_conn *hcon;
-
- BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle);
-
- hcon = hci_conn_hash_lookup_handle(hdev, handle);
- if (!hcon)
- return;
-
- BT_DBG("%s phy handle 0x%2.2x hcon %p", hdev->name, handle, hcon);
-
- amp_write_rem_assoc_frag(hdev, hcon);
-}
-
-static void create_phylink_complete(struct hci_dev *hdev, u8 status,
- u16 opcode)
-{
- struct hci_cp_create_phy_link *cp;
-
- BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
- cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
- if (!cp)
- return;
-
- hci_dev_lock(hdev);
-
- if (status) {
- struct hci_conn *hcon;
-
- hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
- if (hcon)
- hci_conn_del(hcon);
- } else {
- amp_write_remote_assoc(hdev, cp->phy_handle);
- }
-
- hci_dev_unlock(hdev);
-}
-
-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
- struct hci_conn *hcon)
-{
- struct hci_cp_create_phy_link cp;
- struct hci_request req;
-
- cp.phy_handle = hcon->handle;
-
- BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon,
- hcon->handle);
-
- if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len,
- &cp.key_type)) {
- BT_DBG("Cannot create link key");
- return;
- }
-
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_CREATE_PHY_LINK, sizeof(cp), &cp);
- hci_req_run(&req, create_phylink_complete);
-}
-
-static void accept_phylink_complete(struct hci_dev *hdev, u8 status,
- u16 opcode)
-{
- struct hci_cp_accept_phy_link *cp;
-
- BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
- if (status)
- return;
-
- cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
- if (!cp)
- return;
-
- amp_write_remote_assoc(hdev, cp->phy_handle);
-}
-
-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
- struct hci_conn *hcon)
-{
- struct hci_cp_accept_phy_link cp;
- struct hci_request req;
-
- cp.phy_handle = hcon->handle;
-
- BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon,
- hcon->handle);
-
- if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len,
- &cp.key_type)) {
- BT_DBG("Cannot create link key");
- return;
- }
-
- hci_req_init(&req, hdev);
- hci_req_add(&req, HCI_OP_ACCEPT_PHY_LINK, sizeof(cp), &cp);
- hci_req_run(&req, accept_phylink_complete);
-}
-
-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon)
-{
- struct hci_dev *bredr_hdev = hci_dev_hold(bredr_hcon->hdev);
- struct amp_mgr *mgr = hs_hcon->amp_mgr;
- struct l2cap_chan *bredr_chan;
-
- BT_DBG("bredr_hcon %p hs_hcon %p mgr %p", bredr_hcon, hs_hcon, mgr);
-
- if (!bredr_hdev || !mgr || !mgr->bredr_chan)
- return;
-
- bredr_chan = mgr->bredr_chan;
-
- l2cap_chan_lock(bredr_chan);
-
- set_bit(FLAG_EFS_ENABLE, &bredr_chan->flags);
- bredr_chan->remote_amp_id = hs_hcon->remote_id;
- bredr_chan->local_amp_id = hs_hcon->hdev->id;
- bredr_chan->hs_hcon = hs_hcon;
- bredr_chan->conn->mtu = hs_hcon->hdev->block_mtu;
-
- __l2cap_physical_cfm(bredr_chan, 0);
-
- l2cap_chan_unlock(bredr_chan);
-
- hci_dev_put(bredr_hdev);
-}
-
-void amp_create_logical_link(struct l2cap_chan *chan)
-{
- struct hci_conn *hs_hcon = chan->hs_hcon;
- struct hci_cp_create_accept_logical_link cp;
- struct hci_dev *hdev;
-
- BT_DBG("chan %p hs_hcon %p dst %pMR", chan, hs_hcon,
- &chan->conn->hcon->dst);
-
- if (!hs_hcon)
- return;
-
- hdev = hci_dev_hold(chan->hs_hcon->hdev);
- if (!hdev)
- return;
-
- cp.phy_handle = hs_hcon->handle;
-
- cp.tx_flow_spec.id = chan->local_id;
- cp.tx_flow_spec.stype = chan->local_stype;
- cp.tx_flow_spec.msdu = cpu_to_le16(chan->local_msdu);
- cp.tx_flow_spec.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
- cp.tx_flow_spec.acc_lat = cpu_to_le32(chan->local_acc_lat);
- cp.tx_flow_spec.flush_to = cpu_to_le32(chan->local_flush_to);
-
- cp.rx_flow_spec.id = chan->remote_id;
- cp.rx_flow_spec.stype = chan->remote_stype;
- cp.rx_flow_spec.msdu = cpu_to_le16(chan->remote_msdu);
- cp.rx_flow_spec.sdu_itime = cpu_to_le32(chan->remote_sdu_itime);
- cp.rx_flow_spec.acc_lat = cpu_to_le32(chan->remote_acc_lat);
- cp.rx_flow_spec.flush_to = cpu_to_le32(chan->remote_flush_to);
-
- if (hs_hcon->out)
- hci_send_cmd(hdev, HCI_OP_CREATE_LOGICAL_LINK, sizeof(cp),
- &cp);
- else
- hci_send_cmd(hdev, HCI_OP_ACCEPT_LOGICAL_LINK, sizeof(cp),
- &cp);
-
- hci_dev_put(hdev);
-}
-
-void amp_disconnect_logical_link(struct hci_chan *hchan)
-{
- struct hci_conn *hcon = hchan->conn;
- struct hci_cp_disconn_logical_link cp;
-
- if (hcon->state != BT_CONNECTED) {
- BT_DBG("hchan %p not connected", hchan);
- return;
- }
-
- cp.log_handle = cpu_to_le16(hchan->handle);
- hci_send_cmd(hcon->hdev, HCI_OP_DISCONN_LOGICAL_LINK, sizeof(cp), &cp);
-}
-
-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason)
-{
- BT_DBG("hchan %p", hchan);
-
- hci_chan_del(hchan);
-}
--- a/net/bluetooth/amp.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- Copyright (c) 2011,2012 Intel Corp.
-
-*/
-
-#ifndef __AMP_H
-#define __AMP_H
-
-struct amp_ctrl {
- struct list_head list;
- struct kref kref;
- __u8 id;
- __u16 assoc_len_so_far;
- __u16 assoc_rem_len;
- __u16 assoc_len;
- __u8 *assoc;
-};
-
-int amp_ctrl_put(struct amp_ctrl *ctrl);
-void amp_ctrl_get(struct amp_ctrl *ctrl);
-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id);
-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id);
-void amp_ctrl_list_flush(struct amp_mgr *mgr);
-
-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
- u8 remote_id, bool out);
-
-int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type);
-
-void amp_read_loc_info(struct hci_dev *hdev, struct amp_mgr *mgr);
-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle);
-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr);
-void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
- struct hci_conn *hcon);
-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
- struct hci_conn *hcon);
-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
- struct hci_conn *hcon);
-
-#if IS_ENABLED(CONFIG_BT_HS)
-void amp_create_logical_link(struct l2cap_chan *chan);
-void amp_disconnect_logical_link(struct hci_chan *hchan);
-#else
-static inline void amp_create_logical_link(struct l2cap_chan *chan)
-{
-}
-
-static inline void amp_disconnect_logical_link(struct hci_chan *hchan)
-{
-}
-#endif
-
-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle);
-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle);
-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon);
-void amp_create_logical_link(struct l2cap_chan *chan);
-void amp_disconnect_logical_link(struct hci_chan *hchan);
-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason);
-
-#endif /* __AMP_H */
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -35,7 +35,6 @@
#include "hci_request.h"
#include "smp.h"
-#include "a2mp.h"
#include "eir.h"
struct sco_param {
@@ -1162,9 +1161,6 @@ int hci_conn_del(struct hci_conn *conn)
}
}
- if (conn->amp_mgr)
- amp_mgr_put(conn->amp_mgr);
-
skb_queue_purge(&conn->data_q);
/* Remove the connection from the list and cleanup its remaining
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -35,8 +35,6 @@
#include "hci_request.h"
#include "hci_debugfs.h"
#include "hci_codec.h"
-#include "a2mp.h"
-#include "amp.h"
#include "smp.h"
#include "msft.h"
#include "eir.h"
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -39,8 +39,6 @@
#include <net/bluetooth/l2cap.h>
#include "smp.h"
-#include "a2mp.h"
-#include "amp.h"
#define LE_FLOWCTL_MAX_CREDITS 65535
@@ -167,24 +165,6 @@ static struct l2cap_chan *__l2cap_get_ch
return NULL;
}
-static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
- u8 ident)
-{
- struct l2cap_chan *c;
-
- mutex_lock(&conn->chan_lock);
- c = __l2cap_get_chan_by_ident(conn, ident);
- if (c) {
- /* Only lock if chan reference is not 0 */
- c = l2cap_chan_hold_unless_zero(c);
- if (c)
- l2cap_chan_lock(c);
- }
- mutex_unlock(&conn->chan_lock);
-
- return c;
-}
-
static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
u8 src_type)
{
@@ -682,7 +662,6 @@ void l2cap_chan_del(struct l2cap_chan *c
chan->ops->teardown(chan, err);
if (conn) {
- struct amp_mgr *mgr = conn->hcon->amp_mgr;
/* Delete from channel list */
list_del(&chan->list);
@@ -697,16 +676,6 @@ void l2cap_chan_del(struct l2cap_chan *c
if (chan->chan_type != L2CAP_CHAN_FIXED ||
test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
hci_conn_drop(conn->hcon);
-
- if (mgr && mgr->bredr_chan == chan)
- mgr->bredr_chan = NULL;
- }
-
- if (chan->hs_hchan) {
- struct hci_chan *hs_hchan = chan->hs_hchan;
-
- BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
- amp_disconnect_logical_link(hs_hchan);
}
if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
@@ -1008,12 +977,6 @@ static void l2cap_send_cmd(struct l2cap_
hci_send_acl(conn->hchan, skb, flags);
}
-static bool __chan_is_moving(struct l2cap_chan *chan)
-{
- return chan->move_state != L2CAP_MOVE_STABLE &&
- chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
-}
-
static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
{
struct hci_conn *hcon = chan->conn->hcon;
@@ -1022,15 +985,6 @@ static void l2cap_do_send(struct l2cap_c
BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
skb->priority);
- if (chan->hs_hcon && !__chan_is_moving(chan)) {
- if (chan->hs_hchan)
- hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
- else
- kfree_skb(skb);
-
- return;
- }
-
/* Use NO_FLUSH for LE links (where this is the only option) or
* if the BR/EDR link supports it and flushing has not been
* explicitly requested (through FLAG_FLUSHABLE).
@@ -1211,9 +1165,6 @@ static void l2cap_send_sframe(struct l2c
if (!control->sframe)
return;
- if (__chan_is_moving(chan))
- return;
-
if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
!control->poll)
control->final = 1;
@@ -1268,40 +1219,6 @@ static inline int __l2cap_no_conn_pendin
return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
}
-static bool __amp_capable(struct l2cap_chan *chan)
-{
- struct l2cap_conn *conn = chan->conn;
- struct hci_dev *hdev;
- bool amp_available = false;
-
- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
- return false;
-
- if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
- return false;
-
- read_lock(&hci_dev_list_lock);
- list_for_each_entry(hdev, &hci_dev_list, list) {
- if (hdev->amp_type != AMP_TYPE_BREDR &&
- test_bit(HCI_UP, &hdev->flags)) {
- amp_available = true;
- break;
- }
- }
- read_unlock(&hci_dev_list_lock);
-
- if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
- return amp_available;
-
- return false;
-}
-
-static bool l2cap_check_efs(struct l2cap_chan *chan)
-{
- /* Check EFS parameters */
- return true;
-}
-
void l2cap_send_conn_req(struct l2cap_chan *chan)
{
struct l2cap_conn *conn = chan->conn;
@@ -1317,76 +1234,6 @@ void l2cap_send_conn_req(struct l2cap_ch
l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
}
-static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
-{
- struct l2cap_create_chan_req req;
- req.scid = cpu_to_le16(chan->scid);
- req.psm = chan->psm;
- req.amp_id = amp_id;
-
- chan->ident = l2cap_get_ident(chan->conn);
-
- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
- sizeof(req), &req);
-}
-
-static void l2cap_move_setup(struct l2cap_chan *chan)
-{
- struct sk_buff *skb;
-
- BT_DBG("chan %p", chan);
-
- if (chan->mode != L2CAP_MODE_ERTM)
- return;
-
- __clear_retrans_timer(chan);
- __clear_monitor_timer(chan);
- __clear_ack_timer(chan);
-
- chan->retry_count = 0;
- skb_queue_walk(&chan->tx_q, skb) {
- if (bt_cb(skb)->l2cap.retries)
- bt_cb(skb)->l2cap.retries = 1;
- else
- break;
- }
-
- chan->expected_tx_seq = chan->buffer_seq;
-
- clear_bit(CONN_REJ_ACT, &chan->conn_state);
- clear_bit(CONN_SREJ_ACT, &chan->conn_state);
- l2cap_seq_list_clear(&chan->retrans_list);
- l2cap_seq_list_clear(&chan->srej_list);
- skb_queue_purge(&chan->srej_q);
-
- chan->tx_state = L2CAP_TX_STATE_XMIT;
- chan->rx_state = L2CAP_RX_STATE_MOVE;
-
- set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-}
-
-static void l2cap_move_done(struct l2cap_chan *chan)
-{
- u8 move_role = chan->move_role;
- BT_DBG("chan %p", chan);
-
- chan->move_state = L2CAP_MOVE_STABLE;
- chan->move_role = L2CAP_MOVE_ROLE_NONE;
-
- if (chan->mode != L2CAP_MODE_ERTM)
- return;
-
- switch (move_role) {
- case L2CAP_MOVE_ROLE_INITIATOR:
- l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
- chan->rx_state = L2CAP_RX_STATE_WAIT_F;
- break;
- case L2CAP_MOVE_ROLE_RESPONDER:
- chan->rx_state = L2CAP_RX_STATE_WAIT_P;
- break;
- }
-}
-
static void l2cap_chan_ready(struct l2cap_chan *chan)
{
/* The channel may have already been flagged as connected in
@@ -1536,10 +1383,7 @@ static void l2cap_le_start(struct l2cap_
static void l2cap_start_connection(struct l2cap_chan *chan)
{
- if (__amp_capable(chan)) {
- BT_DBG("chan %p AMP capable: discover AMPs", chan);
- a2mp_discover_amp(chan);
- } else if (chan->conn->hcon->type == LE_LINK) {
+ if (chan->conn->hcon->type == LE_LINK) {
l2cap_le_start(chan);
} else {
l2cap_send_conn_req(chan);
@@ -1643,11 +1487,6 @@ static void l2cap_send_disconn_req(struc
__clear_ack_timer(chan);
}
- if (chan->scid == L2CAP_CID_A2MP) {
- l2cap_state_change(chan, BT_DISCONN);
- return;
- }
-
req.dcid = cpu_to_le16(chan->dcid);
req.scid = cpu_to_le16(chan->scid);
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
@@ -1786,11 +1625,6 @@ static void l2cap_conn_ready(struct l2ca
l2cap_chan_lock(chan);
- if (chan->scid == L2CAP_CID_A2MP) {
- l2cap_chan_unlock(chan);
- continue;
- }
-
if (hcon->type == LE_LINK) {
l2cap_le_start(chan);
} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
@@ -2100,9 +1934,6 @@ static void l2cap_streaming_send(struct
BT_DBG("chan %p, skbs %p", chan, skbs);
- if (__chan_is_moving(chan))
- return;
-
skb_queue_splice_tail_init(skbs, &chan->tx_q);
while (!skb_queue_empty(&chan->tx_q)) {
@@ -2145,9 +1976,6 @@ static int l2cap_ertm_send(struct l2cap_
if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
return 0;
- if (__chan_is_moving(chan))
- return 0;
-
while (chan->tx_send_head &&
chan->unacked_frames < chan->remote_tx_win &&
chan->tx_state == L2CAP_TX_STATE_XMIT) {
@@ -2213,9 +2041,6 @@ static void l2cap_ertm_resend(struct l2c
if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
return;
- if (__chan_is_moving(chan))
- return;
-
while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
seq = l2cap_seq_list_pop(&chan->retrans_list);
@@ -2555,8 +2380,7 @@ static int l2cap_segment_sdu(struct l2ca
pdu_len = chan->conn->mtu;
/* Constrain PDU size for BR/EDR connections */
- if (!chan->hs_hcon)
- pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
+ pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
/* Adjust for largest possible L2CAP overhead. */
if (chan->fcs)
@@ -3334,11 +3158,6 @@ int l2cap_ertm_init(struct l2cap_chan *c
skb_queue_head_init(&chan->tx_q);
- chan->local_amp_id = AMP_ID_BREDR;
- chan->move_id = AMP_ID_BREDR;
- chan->move_state = L2CAP_MOVE_STABLE;
- chan->move_role = L2CAP_MOVE_ROLE_NONE;
-
if (chan->mode != L2CAP_MODE_ERTM)
return 0;
@@ -3373,52 +3192,19 @@ static inline __u8 l2cap_select_mode(__u
static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
{
- return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
- (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
+ return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
}
static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
{
- return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
- (conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
+ return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
}
static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
struct l2cap_conf_rfc *rfc)
{
- if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
- u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
-
- /* Class 1 devices have must have ERTM timeouts
- * exceeding the Link Supervision Timeout. The
- * default Link Supervision Timeout for AMP
- * controllers is 10 seconds.
- *
- * Class 1 devices use 0xffffffff for their
- * best-effort flush timeout, so the clamping logic
- * will result in a timeout that meets the above
- * requirement. ERTM timeouts are 16-bit values, so
- * the maximum timeout is 65.535 seconds.
- */
-
- /* Convert timeout to milliseconds and round */
- ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
-
- /* This is the recommended formula for class 2 devices
- * that start ERTM timers when packets are sent to the
- * controller.
- */
- ertm_to = 3 * ertm_to + 500;
-
- if (ertm_to > 0xffff)
- ertm_to = 0xffff;
-
- rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
- rfc->monitor_timeout = rfc->retrans_timeout;
- } else {
- rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
- rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
- }
+ rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+ rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
}
static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
@@ -3673,13 +3459,7 @@ static int l2cap_parse_conf_req(struct l
case L2CAP_CONF_EWS:
if (olen != 2)
break;
- if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
- return -ECONNREFUSED;
- set_bit(FLAG_EXT_CTRL, &chan->flags);
- set_bit(CONF_EWS_RECV, &chan->conf_state);
- chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
- chan->remote_tx_win = val;
- break;
+ return -ECONNREFUSED;
default:
if (hint)
@@ -4107,11 +3887,7 @@ void __l2cap_connect_rsp_defer(struct l2
rsp.dcid = cpu_to_le16(chan->scid);
rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-
- if (chan->hs_hcon)
- rsp_code = L2CAP_CREATE_CHAN_RSP;
- else
- rsp_code = L2CAP_CONN_RSP;
+ rsp_code = L2CAP_CONN_RSP;
BT_DBG("chan %p rsp_code %u", chan, rsp_code);
@@ -4274,7 +4050,6 @@ static struct l2cap_chan *l2cap_connect(
chan->dst_type = bdaddr_dst_type(conn->hcon);
chan->psm = psm;
chan->dcid = scid;
- chan->local_amp_id = amp_id;
__l2cap_chan_add(conn, chan);
@@ -4593,10 +4368,7 @@ static inline int l2cap_config_req(struc
/* check compatibility */
/* Send rsp for BR/EDR channel */
- if (!chan->hs_hcon)
- l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
- else
- chan->ident = cmd->ident;
+ l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
}
unlock:
@@ -4648,15 +4420,7 @@ static inline int l2cap_config_rsp(struc
goto done;
}
- if (!chan->hs_hcon) {
- l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
- 0);
- } else {
- if (l2cap_check_efs(chan)) {
- amp_create_logical_link(chan);
- chan->ident = cmd->ident;
- }
- }
+ l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
}
goto done;
@@ -4827,9 +4591,6 @@ static inline int l2cap_information_req(
if (!disable_ertm)
feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
| L2CAP_FEAT_FCS;
- if (conn->local_fixed_chan & L2CAP_FC_A2MP)
- feat_mask |= L2CAP_FEAT_EXT_FLOW
- | L2CAP_FEAT_EXT_WINDOW;
put_unaligned_le32(feat_mask, rsp->data);
l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
@@ -4920,751 +4681,6 @@ static inline int l2cap_information_rsp(
return 0;
}
-static int l2cap_create_channel_req(struct l2cap_conn *conn,
- struct l2cap_cmd_hdr *cmd,
- u16 cmd_len, void *data)
-{
- struct l2cap_create_chan_req *req = data;
- struct l2cap_create_chan_rsp rsp;
- struct l2cap_chan *chan;
- struct hci_dev *hdev;
- u16 psm, scid;
-
- if (cmd_len != sizeof(*req))
- return -EPROTO;
-
- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
- return -EINVAL;
-
- psm = le16_to_cpu(req->psm);
- scid = le16_to_cpu(req->scid);
-
- BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
-
- /* For controller id 0 make BR/EDR connection */
- if (req->amp_id == AMP_ID_BREDR) {
- l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
- req->amp_id);
- return 0;
- }
-
- /* Validate AMP controller id */
- hdev = hci_dev_get(req->amp_id);
- if (!hdev)
- goto error;
-
- if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
- hci_dev_put(hdev);
- goto error;
- }
-
- chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
- req->amp_id);
- if (chan) {
- struct amp_mgr *mgr = conn->hcon->amp_mgr;
- struct hci_conn *hs_hcon;
-
- hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
- &conn->hcon->dst);
- if (!hs_hcon) {
- hci_dev_put(hdev);
- cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
- chan->dcid);
- return 0;
- }
-
- BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
-
- mgr->bredr_chan = chan;
- chan->hs_hcon = hs_hcon;
- chan->fcs = L2CAP_FCS_NONE;
- conn->mtu = hdev->block_mtu;
- }
-
- hci_dev_put(hdev);
-
- return 0;
-
-error:
- rsp.dcid = 0;
- rsp.scid = cpu_to_le16(scid);
- rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-
- l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
- sizeof(rsp), &rsp);
-
- return 0;
-}
-
-static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
-{
- struct l2cap_move_chan_req req;
- u8 ident;
-
- BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
-
- ident = l2cap_get_ident(chan->conn);
- chan->ident = ident;
-
- req.icid = cpu_to_le16(chan->scid);
- req.dest_amp_id = dest_amp_id;
-
- l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
- &req);
-
- __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
-}
-
-static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
-{
- struct l2cap_move_chan_rsp rsp;
-
- BT_DBG("chan %p, result 0x%4.4x", chan, result);
-
- rsp.icid = cpu_to_le16(chan->dcid);
- rsp.result = cpu_to_le16(result);
-
- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
- sizeof(rsp), &rsp);
-}
-
-static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
-{
- struct l2cap_move_chan_cfm cfm;
-
- BT_DBG("chan %p, result 0x%4.4x", chan, result);
-
- chan->ident = l2cap_get_ident(chan->conn);
-
- cfm.icid = cpu_to_le16(chan->scid);
- cfm.result = cpu_to_le16(result);
-
- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
- sizeof(cfm), &cfm);
-
- __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
-}
-
-static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
-{
- struct l2cap_move_chan_cfm cfm;
-
- BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
-
- cfm.icid = cpu_to_le16(icid);
- cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
-
- l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
- sizeof(cfm), &cfm);
-}
-
-static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
- u16 icid)
-{
- struct l2cap_move_chan_cfm_rsp rsp;
-
- BT_DBG("icid 0x%4.4x", icid);
-
- rsp.icid = cpu_to_le16(icid);
- l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
-}
-
-static void __release_logical_link(struct l2cap_chan *chan)
-{
- chan->hs_hchan = NULL;
- chan->hs_hcon = NULL;
-
- /* Placeholder - release the logical link */
-}
-
-static void l2cap_logical_fail(struct l2cap_chan *chan)
-{
- /* Logical link setup failed */
- if (chan->state != BT_CONNECTED) {
- /* Create channel failure, disconnect */
- l2cap_send_disconn_req(chan, ECONNRESET);
- return;
- }
-
- switch (chan->move_role) {
- case L2CAP_MOVE_ROLE_RESPONDER:
- l2cap_move_done(chan);
- l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
- break;
- case L2CAP_MOVE_ROLE_INITIATOR:
- if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
- chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
- /* Remote has only sent pending or
- * success responses, clean up
- */
- l2cap_move_done(chan);
- }
-
- /* Other amp move states imply that the move
- * has already aborted
- */
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
- break;
- }
-}
-
-static void l2cap_logical_finish_create(struct l2cap_chan *chan,
- struct hci_chan *hchan)
-{
- struct l2cap_conf_rsp rsp;
-
- chan->hs_hchan = hchan;
- chan->hs_hcon->l2cap_data = chan->conn;
-
- l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
-
- if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
- int err;
-
- set_default_fcs(chan);
-
- err = l2cap_ertm_init(chan);
- if (err < 0)
- l2cap_send_disconn_req(chan, -err);
- else
- l2cap_chan_ready(chan);
- }
-}
-
-static void l2cap_logical_finish_move(struct l2cap_chan *chan,
- struct hci_chan *hchan)
-{
- chan->hs_hcon = hchan->conn;
- chan->hs_hcon->l2cap_data = chan->conn;
-
- BT_DBG("move_state %d", chan->move_state);
-
- switch (chan->move_state) {
- case L2CAP_MOVE_WAIT_LOGICAL_COMP:
- /* Move confirm will be sent after a success
- * response is received
- */
- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
- break;
- case L2CAP_MOVE_WAIT_LOGICAL_CFM:
- if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
- } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
- } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
- l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
- }
- break;
- default:
- /* Move was not in expected state, free the channel */
- __release_logical_link(chan);
-
- chan->move_state = L2CAP_MOVE_STABLE;
- }
-}
-
-/* Call with chan locked */
-void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
- u8 status)
-{
- BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
-
- if (status) {
- l2cap_logical_fail(chan);
- __release_logical_link(chan);
- return;
- }
-
- if (chan->state != BT_CONNECTED) {
- /* Ignore logical link if channel is on BR/EDR */
- if (chan->local_amp_id != AMP_ID_BREDR)
- l2cap_logical_finish_create(chan, hchan);
- } else {
- l2cap_logical_finish_move(chan, hchan);
- }
-}
-
-void l2cap_move_start(struct l2cap_chan *chan)
-{
- BT_DBG("chan %p", chan);
-
- if (chan->local_amp_id == AMP_ID_BREDR) {
- if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
- return;
- chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
- chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
- /* Placeholder - start physical link setup */
- } else {
- chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
- chan->move_id = 0;
- l2cap_move_setup(chan);
- l2cap_send_move_chan_req(chan, 0);
- }
-}
-
-static void l2cap_do_create(struct l2cap_chan *chan, int result,
- u8 local_amp_id, u8 remote_amp_id)
-{
- BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
- local_amp_id, remote_amp_id);
-
- chan->fcs = L2CAP_FCS_NONE;
-
- /* Outgoing channel on AMP */
- if (chan->state == BT_CONNECT) {
- if (result == L2CAP_CR_SUCCESS) {
- chan->local_amp_id = local_amp_id;
- l2cap_send_create_chan_req(chan, remote_amp_id);
- } else {
- /* Revert to BR/EDR connect */
- l2cap_send_conn_req(chan);
- }
-
- return;
- }
-
- /* Incoming channel on AMP */
- if (__l2cap_no_conn_pending(chan)) {
- struct l2cap_conn_rsp rsp;
- char buf[128];
- rsp.scid = cpu_to_le16(chan->dcid);
- rsp.dcid = cpu_to_le16(chan->scid);
-
- if (result == L2CAP_CR_SUCCESS) {
- /* Send successful response */
- rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
- } else {
- /* Send negative response */
- rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
- }
-
- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
- sizeof(rsp), &rsp);
-
- if (result == L2CAP_CR_SUCCESS) {
- l2cap_state_change(chan, BT_CONFIG);
- set_bit(CONF_REQ_SENT, &chan->conf_state);
- l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
- L2CAP_CONF_REQ,
- l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- chan->num_conf_req++;
- }
- }
-}
-
-static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
- u8 remote_amp_id)
-{
- l2cap_move_setup(chan);
- chan->move_id = local_amp_id;
- chan->move_state = L2CAP_MOVE_WAIT_RSP;
-
- l2cap_send_move_chan_req(chan, remote_amp_id);
-}
-
-static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
-{
- struct hci_chan *hchan = NULL;
-
- /* Placeholder - get hci_chan for logical link */
-
- if (hchan) {
- if (hchan->state == BT_CONNECTED) {
- /* Logical link is ready to go */
- chan->hs_hcon = hchan->conn;
- chan->hs_hcon->l2cap_data = chan->conn;
- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
- l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
-
- l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
- } else {
- /* Wait for logical link to be ready */
- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
- }
- } else {
- /* Logical link not available */
- l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
- }
-}
-
-static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
-{
- if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
- u8 rsp_result;
- if (result == -EINVAL)
- rsp_result = L2CAP_MR_BAD_ID;
- else
- rsp_result = L2CAP_MR_NOT_ALLOWED;
-
- l2cap_send_move_chan_rsp(chan, rsp_result);
- }
-
- chan->move_role = L2CAP_MOVE_ROLE_NONE;
- chan->move_state = L2CAP_MOVE_STABLE;
-
- /* Restart data transmission */
- l2cap_ertm_send(chan);
-}
-
-/* Invoke with locked chan */
-void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
-{
- u8 local_amp_id = chan->local_amp_id;
- u8 remote_amp_id = chan->remote_amp_id;
-
- BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
- chan, result, local_amp_id, remote_amp_id);
-
- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
- return;
-
- if (chan->state != BT_CONNECTED) {
- l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
- } else if (result != L2CAP_MR_SUCCESS) {
- l2cap_do_move_cancel(chan, result);
- } else {
- switch (chan->move_role) {
- case L2CAP_MOVE_ROLE_INITIATOR:
- l2cap_do_move_initiate(chan, local_amp_id,
- remote_amp_id);
- break;
- case L2CAP_MOVE_ROLE_RESPONDER:
- l2cap_do_move_respond(chan, result);
- break;
- default:
- l2cap_do_move_cancel(chan, result);
- break;
- }
- }
-}
-
-static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
- struct l2cap_cmd_hdr *cmd,
- u16 cmd_len, void *data)
-{
- struct l2cap_move_chan_req *req = data;
- struct l2cap_move_chan_rsp rsp;
- struct l2cap_chan *chan;
- u16 icid = 0;
- u16 result = L2CAP_MR_NOT_ALLOWED;
-
- if (cmd_len != sizeof(*req))
- return -EPROTO;
-
- icid = le16_to_cpu(req->icid);
-
- BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
-
- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
- return -EINVAL;
-
- chan = l2cap_get_chan_by_dcid(conn, icid);
- if (!chan) {
- rsp.icid = cpu_to_le16(icid);
- rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
- l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
- sizeof(rsp), &rsp);
- return 0;
- }
-
- chan->ident = cmd->ident;
-
- if (chan->scid < L2CAP_CID_DYN_START ||
- chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
- (chan->mode != L2CAP_MODE_ERTM &&
- chan->mode != L2CAP_MODE_STREAMING)) {
- result = L2CAP_MR_NOT_ALLOWED;
- goto send_move_response;
- }
-
- if (chan->local_amp_id == req->dest_amp_id) {
- result = L2CAP_MR_SAME_ID;
- goto send_move_response;
- }
-
- if (req->dest_amp_id != AMP_ID_BREDR) {
- struct hci_dev *hdev;
- hdev = hci_dev_get(req->dest_amp_id);
- if (!hdev || hdev->dev_type != HCI_AMP ||
- !test_bit(HCI_UP, &hdev->flags)) {
- if (hdev)
- hci_dev_put(hdev);
-
- result = L2CAP_MR_BAD_ID;
- goto send_move_response;
- }
- hci_dev_put(hdev);
- }
-
- /* Detect a move collision. Only send a collision response
- * if this side has "lost", otherwise proceed with the move.
- * The winner has the larger bd_addr.
- */
- if ((__chan_is_moving(chan) ||
- chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
- bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
- result = L2CAP_MR_COLLISION;
- goto send_move_response;
- }
-
- chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
- l2cap_move_setup(chan);
- chan->move_id = req->dest_amp_id;
-
- if (req->dest_amp_id == AMP_ID_BREDR) {
- /* Moving to BR/EDR */
- if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
- result = L2CAP_MR_PEND;
- } else {
- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
- result = L2CAP_MR_SUCCESS;
- }
- } else {
- chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
- /* Placeholder - uncomment when amp functions are available */
- /*amp_accept_physical(chan, req->dest_amp_id);*/
- result = L2CAP_MR_PEND;
- }
-
-send_move_response:
- l2cap_send_move_chan_rsp(chan, result);
-
- l2cap_chan_unlock(chan);
- l2cap_chan_put(chan);
-
- return 0;
-}
-
-static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
-{
- struct l2cap_chan *chan;
- struct hci_chan *hchan = NULL;
-
- chan = l2cap_get_chan_by_scid(conn, icid);
- if (!chan) {
- l2cap_send_move_chan_cfm_icid(conn, icid);
- return;
- }
-
- __clear_chan_timer(chan);
- if (result == L2CAP_MR_PEND)
- __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
-
- switch (chan->move_state) {
- case L2CAP_MOVE_WAIT_LOGICAL_COMP:
- /* Move confirm will be sent when logical link
- * is complete.
- */
- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
- break;
- case L2CAP_MOVE_WAIT_RSP_SUCCESS:
- if (result == L2CAP_MR_PEND) {
- break;
- } else if (test_bit(CONN_LOCAL_BUSY,
- &chan->conn_state)) {
- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
- } else {
- /* Logical link is up or moving to BR/EDR,
- * proceed with move
- */
- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
- }
- break;
- case L2CAP_MOVE_WAIT_RSP:
- /* Moving to AMP */
- if (result == L2CAP_MR_SUCCESS) {
- /* Remote is ready, send confirm immediately
- * after logical link is ready
- */
- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
- } else {
- /* Both logical link and move success
- * are required to confirm
- */
- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
- }
-
- /* Placeholder - get hci_chan for logical link */
- if (!hchan) {
- /* Logical link not available */
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
- break;
- }
-
- /* If the logical link is not yet connected, do not
- * send confirmation.
- */
- if (hchan->state != BT_CONNECTED)
- break;
-
- /* Logical link is already ready to go */
-
- chan->hs_hcon = hchan->conn;
- chan->hs_hcon->l2cap_data = chan->conn;
-
- if (result == L2CAP_MR_SUCCESS) {
- /* Can confirm now */
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
- } else {
- /* Now only need move success
- * to confirm
- */
- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
- }
-
- l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
- break;
- default:
- /* Any other amp move state means the move failed. */
- chan->move_id = chan->local_amp_id;
- l2cap_move_done(chan);
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
- }
-
- l2cap_chan_unlock(chan);
- l2cap_chan_put(chan);
-}
-
-static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
- u16 result)
-{
- struct l2cap_chan *chan;
-
- chan = l2cap_get_chan_by_ident(conn, ident);
- if (!chan) {
- /* Could not locate channel, icid is best guess */
- l2cap_send_move_chan_cfm_icid(conn, icid);
- return;
- }
-
- __clear_chan_timer(chan);
-
- if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
- if (result == L2CAP_MR_COLLISION) {
- chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
- } else {
- /* Cleanup - cancel move */
- chan->move_id = chan->local_amp_id;
- l2cap_move_done(chan);
- }
- }
-
- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
-
- l2cap_chan_unlock(chan);
- l2cap_chan_put(chan);
-}
-
-static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
- struct l2cap_cmd_hdr *cmd,
- u16 cmd_len, void *data)
-{
- struct l2cap_move_chan_rsp *rsp = data;
- u16 icid, result;
-
- if (cmd_len != sizeof(*rsp))
- return -EPROTO;
-
- icid = le16_to_cpu(rsp->icid);
- result = le16_to_cpu(rsp->result);
-
- BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
-
- if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
- l2cap_move_continue(conn, icid, result);
- else
- l2cap_move_fail(conn, cmd->ident, icid, result);
-
- return 0;
-}
-
-static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
- struct l2cap_cmd_hdr *cmd,
- u16 cmd_len, void *data)
-{
- struct l2cap_move_chan_cfm *cfm = data;
- struct l2cap_chan *chan;
- u16 icid, result;
-
- if (cmd_len != sizeof(*cfm))
- return -EPROTO;
-
- icid = le16_to_cpu(cfm->icid);
- result = le16_to_cpu(cfm->result);
-
- BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
-
- chan = l2cap_get_chan_by_dcid(conn, icid);
- if (!chan) {
- /* Spec requires a response even if the icid was not found */
- l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
- return 0;
- }
-
- if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
- if (result == L2CAP_MC_CONFIRMED) {
- chan->local_amp_id = chan->move_id;
- if (chan->local_amp_id == AMP_ID_BREDR)
- __release_logical_link(chan);
- } else {
- chan->move_id = chan->local_amp_id;
- }
-
- l2cap_move_done(chan);
- }
-
- l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
-
- l2cap_chan_unlock(chan);
- l2cap_chan_put(chan);
-
- return 0;
-}
-
-static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
- struct l2cap_cmd_hdr *cmd,
- u16 cmd_len, void *data)
-{
- struct l2cap_move_chan_cfm_rsp *rsp = data;
- struct l2cap_chan *chan;
- u16 icid;
-
- if (cmd_len != sizeof(*rsp))
- return -EPROTO;
-
- icid = le16_to_cpu(rsp->icid);
-
- BT_DBG("icid 0x%4.4x", icid);
-
- chan = l2cap_get_chan_by_scid(conn, icid);
- if (!chan)
- return 0;
-
- __clear_chan_timer(chan);
-
- if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
- chan->local_amp_id = chan->move_id;
-
- if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
- __release_logical_link(chan);
-
- l2cap_move_done(chan);
- }
-
- l2cap_chan_unlock(chan);
- l2cap_chan_put(chan);
-
- return 0;
-}
-
static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
struct l2cap_cmd_hdr *cmd,
u16 cmd_len, u8 *data)
@@ -5818,7 +4834,6 @@ static inline int l2cap_bredr_sig_cmd(st
break;
case L2CAP_CONN_RSP:
- case L2CAP_CREATE_CHAN_RSP:
l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
break;
@@ -5853,26 +4868,6 @@ static inline int l2cap_bredr_sig_cmd(st
l2cap_information_rsp(conn, cmd, cmd_len, data);
break;
- case L2CAP_CREATE_CHAN_REQ:
- err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
- break;
-
- case L2CAP_MOVE_CHAN_REQ:
- err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
- break;
-
- case L2CAP_MOVE_CHAN_RSP:
- l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
- break;
-
- case L2CAP_MOVE_CHAN_CFM:
- err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
- break;
-
- case L2CAP_MOVE_CHAN_CFM_RSP:
- l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
- break;
-
default:
BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
err = -EINVAL;
@@ -7251,8 +6246,8 @@ static int l2cap_rx_state_recv(struct l2
if (control->final) {
clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
- if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
- !__chan_is_moving(chan)) {
+ if (!test_and_clear_bit(CONN_REJ_ACT,
+ &chan->conn_state)) {
control->final = 0;
l2cap_retransmit_all(chan, control);
}
@@ -7445,11 +6440,7 @@ static int l2cap_finish_move(struct l2ca
BT_DBG("chan %p", chan);
chan->rx_state = L2CAP_RX_STATE_RECV;
-
- if (chan->hs_hcon)
- chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
- else
- chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+ chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
return l2cap_resegment(chan);
}
@@ -7516,11 +6507,7 @@ static int l2cap_rx_state_wait_f(struct
*/
chan->next_tx_seq = control->reqseq;
chan->unacked_frames = 0;
-
- if (chan->hs_hcon)
- chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
- else
- chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+ chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
err = l2cap_resegment(chan);
@@ -7904,21 +6891,10 @@ static void l2cap_data_channel(struct l2
chan = l2cap_get_chan_by_scid(conn, cid);
if (!chan) {
- if (cid == L2CAP_CID_A2MP) {
- chan = a2mp_channel_create(conn, skb);
- if (!chan) {
- kfree_skb(skb);
- return;
- }
-
- l2cap_chan_hold(chan);
- l2cap_chan_lock(chan);
- } else {
- BT_DBG("unknown cid 0x%4.4x", cid);
- /* Drop packet and return */
- kfree_skb(skb);
- return;
- }
+ BT_DBG("unknown cid 0x%4.4x", cid);
+ /* Drop packet and return */
+ kfree_skb(skb);
+ return;
}
BT_DBG("chan %p, len %d", chan, skb->len);
@@ -8123,10 +7099,6 @@ static struct l2cap_conn *l2cap_conn_add
conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
- if (hcon->type == ACL_LINK &&
- hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
- conn->local_fixed_chan |= L2CAP_FC_A2MP;
-
if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
(bredr_sc_enabled(hcon->hdev) ||
hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
@@ -8591,11 +7563,6 @@ static void l2cap_security_cfm(struct hc
BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
state_to_string(chan->state));
- if (chan->scid == L2CAP_CID_A2MP) {
- l2cap_chan_unlock(chan);
- continue;
- }
-
if (!status && encrypt)
chan->sec_level = hcon->sec_level;
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1023,23 +1023,7 @@ static int l2cap_sock_setsockopt(struct
if (err)
break;
- if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
- err = -EINVAL;
- break;
- }
-
- if (chan->mode != L2CAP_MODE_ERTM &&
- chan->mode != L2CAP_MODE_STREAMING) {
- err = -EOPNOTSUPP;
- break;
- }
-
- chan->chan_policy = (u8) opt;
-
- if (sk->sk_state == BT_CONNECTED &&
- chan->move_role == L2CAP_MOVE_ROLE_NONE)
- l2cap_move_start(chan);
-
+ err = -EOPNOTSUPP;
break;
case BT_SNDMTU:
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -835,8 +835,6 @@ static u32 get_supported_settings(struct
if (lmp_ssp_capable(hdev)) {
settings |= MGMT_SETTING_SSP;
- if (IS_ENABLED(CONFIG_BT_HS))
- settings |= MGMT_SETTING_HS;
}
if (lmp_sc_capable(hdev))
@@ -901,9 +899,6 @@ static u32 get_current_settings(struct h
if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
settings |= MGMT_SETTING_SSP;
- if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
- settings |= MGMT_SETTING_HS;
-
if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
settings |= MGMT_SETTING_ADVERTISING;
@@ -1939,7 +1934,6 @@ static void set_ssp_complete(struct hci_
if (enable && hci_dev_test_and_clear_flag(hdev,
HCI_SSP_ENABLED)) {
- hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
new_settings(hdev, NULL);
}
@@ -1952,12 +1946,6 @@ static void set_ssp_complete(struct hci_
changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
} else {
changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
-
- if (!changed)
- changed = hci_dev_test_and_clear_flag(hdev,
- HCI_HS_ENABLED);
- else
- hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
}
mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
@@ -2021,11 +2009,6 @@ static int set_ssp(struct sock *sk, stru
} else {
changed = hci_dev_test_and_clear_flag(hdev,
HCI_SSP_ENABLED);
- if (!changed)
- changed = hci_dev_test_and_clear_flag(hdev,
- HCI_HS_ENABLED);
- else
- hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
}
err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
@@ -2071,63 +2054,10 @@ failed:
static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
{
- struct mgmt_mode *cp = data;
- bool changed;
- u8 status;
- int err;
-
bt_dev_dbg(hdev, "sock %p", sk);
- if (!IS_ENABLED(CONFIG_BT_HS))
- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
MGMT_STATUS_NOT_SUPPORTED);
-
- status = mgmt_bredr_support(hdev);
- if (status)
- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
-
- if (!lmp_ssp_capable(hdev))
- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
- MGMT_STATUS_NOT_SUPPORTED);
-
- if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
- MGMT_STATUS_REJECTED);
-
- if (cp->val != 0x00 && cp->val != 0x01)
- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
- MGMT_STATUS_INVALID_PARAMS);
-
- hci_dev_lock(hdev);
-
- if (pending_find(MGMT_OP_SET_SSP, hdev)) {
- err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
- MGMT_STATUS_BUSY);
- goto unlock;
- }
-
- if (cp->val) {
- changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
- } else {
- if (hdev_is_powered(hdev)) {
- err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
- MGMT_STATUS_REJECTED);
- goto unlock;
- }
-
- changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
- }
-
- err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
- if (err < 0)
- goto unlock;
-
- if (changed)
- err = new_settings(hdev, sk);
-
-unlock:
- hci_dev_unlock(hdev);
- return err;
}
static void set_le_complete(struct hci_dev *hdev, void *data, int err)
@@ -6839,7 +6769,6 @@ static int set_bredr(struct sock *sk, st
hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
- hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
}
hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
next prev parent reply other threads:[~2026-07-21 21:51 UTC|newest]
Thread overview: 1078+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-21 15:10 [PATCH 6.1 0000/1067] 6.1.178-rc1 review Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0001/1067] nvmet-tcp: fix race between ICReq handling and queue teardown Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0002/1067] bpf, arm64: Reject out-of-range B.cond targets Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0003/1067] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0004/1067] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0005/1067] LoongArch: Report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0006/1067] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0007/1067] net/sched: act_pedit: use NLA_POLICY for parsing ex keys Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0008/1067] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0009/1067] slimbus: qcom-ngd-ctrl: Fix probe error path ordering Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0010/1067] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0011/1067] slimbus: Convert to platform remove callback returning void Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0012/1067] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0013/1067] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0014/1067] device property: initialize the remaining fields of fwnode_handle in fwnode_init() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0015/1067] f2fs: keep atomic write retry from zeroing original data Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0016/1067] f2fs: validate orphan inode entry count Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0017/1067] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0018/1067] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0019/1067] f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0020/1067] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0021/1067] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0022/1067] block: Avoid mounting the bdev pseudo-filesystem in userspace Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0023/1067] rpmsg: char: Fix use-after-free on probe error path Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0024/1067] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0025/1067] i2c: core: fix hang " Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0026/1067] i2c: core: fix NULL-deref " Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0027/1067] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0028/1067] i2c: core: fix adapter registration race Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0029/1067] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0030/1067] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0031/1067] nfsd: Dont reset the write verifier on a commit EAGAIN Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0032/1067] apparmor: advertise the tcp fast open fix is applied Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0033/1067] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0034/1067] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0035/1067] mm/vmscan: flush deferred TLB before freeing large folios Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0036/1067] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0037/1067] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0038/1067] eventpoll: dont decrement ep refcount while still holding the ep mutex Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0039/1067] file: add fput() cleanup helper Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0040/1067] eventpoll: use hlist_is_singular_node() in __ep_remove() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0041/1067] eventpoll: split __ep_remove() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0042/1067] eventpoll: kill __ep_remove() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0043/1067] eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0044/1067] eventpoll: rename ep_remove_safe() back to ep_remove() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0045/1067] eventpoll: move epi_fget() up Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0046/1067] eventpoll: fix ep_remove struct eventpoll / struct file UAF Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0047/1067] ACPI: CPPC: Suppress UBSAN warning caused by field misuse Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0048/1067] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0049/1067] perf/core: Detach event groups during remove_on_exec Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0050/1067] virtio_net: Support dynamic rss indirection table size Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0051/1067] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0052/1067] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0053/1067] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0054/1067] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0055/1067] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0056/1067] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0057/1067] iio: adc: spear: " Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.1 0058/1067] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0059/1067] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0060/1067] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0061/1067] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0062/1067] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0063/1067] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0064/1067] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0065/1067] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0066/1067] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0067/1067] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0068/1067] iio: light: tsl2591: return actual error from probe IRQ failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0069/1067] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0070/1067] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0071/1067] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0072/1067] ALSA: virtio: Add missing 384 kHz PCM rate mapping Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0073/1067] ALSA: ymfpci: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0074/1067] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0075/1067] ALSA: cmipci: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0076/1067] ALSA: es1938: " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0077/1067] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0078/1067] ALSA: gus: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0079/1067] ALSA: ice1712: " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0080/1067] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0081/1067] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0082/1067] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0083/1067] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0084/1067] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0085/1067] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0086/1067] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0087/1067] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0088/1067] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0089/1067] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0090/1067] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0091/1067] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0092/1067] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0093/1067] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0094/1067] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0095/1067] mm/damon/ops-common: handle extreme intervals in damon_hot_score() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0096/1067] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0097/1067] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0098/1067] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0099/1067] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0100/1067] usb: dwc3: run gadget disconnect from sleepable suspend context Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0101/1067] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0102/1067] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0103/1067] staging: vme_user: bound slave read/write to the kern_buf size Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0104/1067] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0105/1067] staging: vme_user: fix location monitor leak in fake bridge Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0106/1067] staging: vme_user: fix location monitor leak in tsi148 bridge Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0107/1067] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0108/1067] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0109/1067] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0110/1067] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0111/1067] staging: rtl8723bs: fix OOB read in update_beacon_info() " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0112/1067] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0113/1067] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0114/1067] staging: rtl8723bs: fix OOB write in HT_caps_handler() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0115/1067] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0116/1067] ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0117/1067] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.1 0118/1067] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0119/1067] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0120/1067] fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0121/1067] NTB: epf: Avoid calling pci_irq_vector() from hardirq context Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0122/1067] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0123/1067] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0124/1067] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0125/1067] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0126/1067] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0127/1067] netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0128/1067] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0129/1067] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0130/1067] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0131/1067] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0132/1067] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0133/1067] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0134/1067] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0135/1067] ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0136/1067] ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0137/1067] ksmbd: serialize QUERY_DIRECTORY requests per file Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0138/1067] ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0139/1067] ksmbd: require source read access for duplicate extents Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0140/1067] ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0141/1067] ksmbd: run set info with opener credentials Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0142/1067] ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0143/1067] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0144/1067] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0145/1067] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0146/1067] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0147/1067] firmware_loader: fix device reference leak in firmware_upload_register() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0148/1067] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0149/1067] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0150/1067] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0151/1067] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0152/1067] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0153/1067] clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0154/1067] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0155/1067] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0156/1067] HID: letsketch: fix UAF on inrange_timer at driver unbind Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0157/1067] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0158/1067] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0159/1067] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0160/1067] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0161/1067] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0162/1067] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0163/1067] bpf: Reject fragmented frames in devmap Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0164/1067] bpf: Restore sysctl new-value from 1 to 0 Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0165/1067] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0166/1067] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0167/1067] usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0168/1067] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0169/1067] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0170/1067] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0171/1067] usb: gadget: udc: Fix use-after-free in gadget_match_driver Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0172/1067] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0173/1067] USB: ldusb: " Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0174/1067] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0175/1067] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0176/1067] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0177/1067] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.1 0178/1067] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0179/1067] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0180/1067] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0181/1067] USB: serial: keyspan_pda: fix information leak Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0182/1067] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0183/1067] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0184/1067] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0185/1067] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0186/1067] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0187/1067] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0188/1067] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0189/1067] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0190/1067] usb: typec: anx7411: use devm_pm_runtime_enable() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0191/1067] usb: typec: class: drop PD lookup reference Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0192/1067] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0193/1067] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0194/1067] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0195/1067] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0196/1067] usb: typec: ucsi: cancel pending work on system suspend Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0197/1067] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0198/1067] efivarfs: expose used and total size Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0199/1067] efivarfs: fix statfs() on efivarfs Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0200/1067] udf: validate free block extents against the partition length Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0201/1067] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0202/1067] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0203/1067] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0204/1067] nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0205/1067] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0206/1067] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0207/1067] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0208/1067] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0209/1067] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0210/1067] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0211/1067] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0212/1067] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0213/1067] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0214/1067] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0215/1067] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0216/1067] crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0217/1067] crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0218/1067] crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0219/1067] crypto: talitos - move code in current_desc_hdr() into a standalone function Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0220/1067] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0221/1067] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0222/1067] EDAC/i10nm: Dont fail probing if ADXL is missing Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0223/1067] watchdog: apple: Add "apple,t8103-wdt" compatible Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0224/1067] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0225/1067] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0226/1067] module: decompress: check return value of module_extend_max_pages() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0227/1067] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0228/1067] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0229/1067] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0230/1067] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0231/1067] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0232/1067] i2c: core: fix adapter deregistration race Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0233/1067] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0234/1067] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0235/1067] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0236/1067] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0237/1067] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.1 0238/1067] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0239/1067] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0240/1067] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0241/1067] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0242/1067] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0243/1067] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0244/1067] Input: maplemouse " Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0245/1067] Input: maplecontrol " Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0246/1067] RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0247/1067] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0248/1067] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0249/1067] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0250/1067] ipv4: account for fraggap on the paged allocation path Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0251/1067] smb: client: reject overlapping data areas in SMB2 responses Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0252/1067] xfs: fail recovery on a committed log item with no regions Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0253/1067] xfs: resample the data fork mapping after cycling ILOCK Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0254/1067] smb/server: do not require delete access for non-replacing links Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0255/1067] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0256/1067] fs: quota: create dedicated workqueue for quota_release_work Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0257/1067] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0258/1067] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0259/1067] net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0260/1067] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0261/1067] nvmet-tcp: Fix potential UAF when ddgst mismatch Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0262/1067] crypto: sun4i-ss - Remove insecure and unused rng_alg Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0263/1067] x86/mm: Fix check/use ordering in switch_mm_irqs_off() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0264/1067] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0265/1067] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0266/1067] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0267/1067] crypto: hisi-trng - Remove crypto_rng interface Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0268/1067] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0269/1067] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0270/1067] dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0271/1067] dt-bindings: power: imx93: Add MIPI PHY power domain Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0272/1067] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0273/1067] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0274/1067] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0275/1067] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0276/1067] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0277/1067] fbcon: fix NULL pointer dereference for a console without vc_data Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0278/1067] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0279/1067] drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0280/1067] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0281/1067] libbpf: Report error when a negative kprobe offset is specified Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0282/1067] Documentation: proc: fix section numbering in table of contents Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0283/1067] wifi: cfg80211: fix grammar in MLO group key error message Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0284/1067] arm64: tegra: Fix Tegra234 MGBE PTP clock Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0285/1067] drm/amdkfd: Validate CRIU-restored IDs before idr_alloc Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0286/1067] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0287/1067] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0288/1067] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0289/1067] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0290/1067] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0291/1067] watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0292/1067] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0293/1067] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0294/1067] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0295/1067] arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0296/1067] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0297/1067] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.1 0298/1067] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0299/1067] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0300/1067] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0301/1067] arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0302/1067] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0303/1067] drm/hisilicon/hibmc: move display contrl config to hibmc_probe() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0304/1067] drm/hisilicon/hibmc: use clock to look up the PLL value Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0305/1067] evm: terminate and bound the evm_xattrs read buffer Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0306/1067] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0307/1067] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0308/1067] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0309/1067] net/sched: sch_htb: do not change sch->flags in htb_dump() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0310/1067] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0311/1067] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0312/1067] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0313/1067] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0314/1067] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0315/1067] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0316/1067] firmware: arm_scmi: Read sensor config as 32-bit value Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0317/1067] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0318/1067] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0319/1067] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0320/1067] firmware: arm_scmi: Fix OOB in scmi_power_name_get() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0321/1067] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0322/1067] driver core: Use mod_delayed_work to prevent lost deferred probe work Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0323/1067] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0324/1067] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0325/1067] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0326/1067] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0327/1067] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0328/1067] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0329/1067] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0330/1067] RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0331/1067] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0332/1067] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0333/1067] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0334/1067] mips: ralink: mt7621: add missing __iomem Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0335/1067] mips: n64: add __iomem for writel call Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0336/1067] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0337/1067] ALSA: seq: midi: Serialize output teardown with event_input Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0338/1067] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0339/1067] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0340/1067] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0341/1067] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0342/1067] gpu: host1x: Allow entries in BO caches to be freed Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0343/1067] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0344/1067] gpu: host1x: Fix iommu_map_sgtable() return value check Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0345/1067] drm/tegra: " Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0346/1067] drm/nouveau/bios: specify correct display fuse register for Ampere and Ada Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0347/1067] libbpf: Harden parse_vma_segs() path parsing Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0348/1067] libbpf: Fix UAF in strset__add_str() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0349/1067] dax/kmem: account for partial discontiguous resource upon removal Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0350/1067] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0351/1067] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0352/1067] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0353/1067] crypto: hisilicon/qm - disable error report before flr Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0354/1067] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0355/1067] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0356/1067] EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0357/1067] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.1 0358/1067] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0359/1067] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0360/1067] media: qcom: venus: relax encoder frame/blur dimension steps on v4 Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0361/1067] media: qcom: venus: relax encoder frame/blur step size on v6 Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0362/1067] md/raid10: reset read_slot when reusing r10bio for discard Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0363/1067] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0364/1067] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0365/1067] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0366/1067] nvdimm/btt: Handle preemption in BTT lane acquisition Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0367/1067] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0368/1067] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0369/1067] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0370/1067] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0371/1067] sched: restore timer_slack_ns when resetting RT policy on fork Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0372/1067] lib/test_meminit: use && for bools Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0373/1067] configfs_lookup(): dont leave ->s_dentry dangling on failure Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0374/1067] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0375/1067] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0376/1067] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0377/1067] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0378/1067] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0379/1067] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0380/1067] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0381/1067] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0382/1067] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0383/1067] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0384/1067] IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0385/1067] RDMA/irdma: Fix OOB read during CQ MR registration Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0386/1067] bpf: Check tail zero of bpf_prog_info Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0387/1067] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0388/1067] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0389/1067] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0390/1067] wifi: wcn36xx: fix OOB read from short trigger BA firmware response Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0391/1067] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0392/1067] ALSA: seq: Introduce SNDRV_SEQ_IOCTL_USER_PVERSION ioctl Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0393/1067] ALSA: seq: Add UMP support Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0394/1067] ALSA: seq: Clear variable event pointer on read Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0395/1067] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0396/1067] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0397/1067] IB/mlx5: Dont take the rereg_mr fallback without a new translation Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0398/1067] IB/mlx5: Properly support implicit ODP rereg_mr Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0399/1067] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0400/1067] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0401/1067] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0402/1067] watchdog: unregister PM notifier on watchdog unregister Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0403/1067] scsi: target: Fix hexadecimal CHAP_I handling Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0404/1067] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0405/1067] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0406/1067] vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0407/1067] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0408/1067] wifi: mt76: fix argument to ieee80211_is_first_frag() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0409/1067] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0410/1067] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0411/1067] btrfs: zoned: dont account data relocation space-info in statfs free space Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0412/1067] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0413/1067] vduse: hold vduse_lock across IDR lookup in open path Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0414/1067] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0415/1067] vduse: Requeue failed read to send_list head Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0416/1067] vhost/net: complete zerocopy ubufs only once Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0417/1067] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.1 0418/1067] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0419/1067] selftests/bpf: Fix bpf_iter/task_vma test Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0420/1067] cxl/test: Fix integer overflow in mock LSA bounds checks Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0421/1067] bpf: Tighten cgroup storage cookie checks for prog arrays Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0422/1067] s390/process: Fix kernel thread function pointer type Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0423/1067] Bluetooth: eir: Fix stack OOB write when prepending the Flags AD Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0424/1067] Bluetooth: hci: validate codec capability element length Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0425/1067] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0426/1067] RDMA/mlx5: Remove raw RSS QP restrack tracking Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0427/1067] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0428/1067] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0429/1067] ASoC: codecs: hdac_hdmi: Validate written enum value Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0430/1067] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0431/1067] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0432/1067] net/sched: cls_flow: Dont expose folded kernel pointers Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0433/1067] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0434/1067] bridge: cfm: reject invalid CCM interval at configuration time Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0435/1067] sctp: validate embedded address parameter length Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0436/1067] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0437/1067] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0438/1067] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0439/1067] tipc: reject inverted service ranges from peer bindings Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0440/1067] cxl/test: Add check after kzalloc() memory in alloc_mock_res() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0441/1067] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0442/1067] crypto: cavium/cpt " Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0443/1067] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0444/1067] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0445/1067] ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0446/1067] power: supply: core: fix supplied_from allocations Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0447/1067] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0448/1067] net/sched: sch_codel: " Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0449/1067] net: mana: initialize gdma queue id to INVALID_QUEUE_ID Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0450/1067] net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0451/1067] bpf: Run generic devmap egress prog on private skb Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0452/1067] net/mlx5: Check max_macs devlink param value against max capability Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0453/1067] net: bcmgenet: Use weighted round-robin TX DMA arbitration Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0454/1067] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0455/1067] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0456/1067] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0457/1067] cifs: remove all cifs files before kill super Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0458/1067] smb/client: always return a value for FS_IOC_GETFLAGS Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0459/1067] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0460/1067] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0461/1067] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0462/1067] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0463/1067] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0464/1067] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0465/1067] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0466/1067] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0467/1067] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0468/1067] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0469/1067] ksmbd: fix use-after-free in same_client_has_lease() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0470/1067] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0471/1067] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0472/1067] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0473/1067] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0474/1067] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0475/1067] PCI/ASPM: Dont reconfigure ASPM entering low-power state Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0476/1067] PCI: Introduce named defines for PCI ROM Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0477/1067] PCI: Check ROM header and data structure addr before accessing Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.1 0478/1067] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0479/1067] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0480/1067] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0481/1067] PCI: loongson: Do not ignore downstream devices on external bridges Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0482/1067] bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0483/1067] phy: phy-can-transceiver: Check driver match and driver data against NULL Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0484/1067] mailbox: mtk-adsp: fix UAF during device teardown Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0485/1067] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0486/1067] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0487/1067] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0488/1067] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0489/1067] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0490/1067] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0491/1067] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0492/1067] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0493/1067] iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0494/1067] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0495/1067] clk: at91: keep securam node alive while mapping it Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0496/1067] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0497/1067] fs/ntfs3: add bounds check to run_get_highest_vcn() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0498/1067] drm/amd/display: Add missing kdoc for ALLM parameters Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0499/1067] dmaengine: imx-sdma: Refine spba bus searching in probe Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0500/1067] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0501/1067] perf sched: Replace BUG_ON on invalid CPU with graceful skip Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0502/1067] perf sched: Fix NULL dereference in latency_runtime_event Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0503/1067] perf tools: Add bounds check to cpu__get_node() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0504/1067] perf mmap: Guard cpu__get_node() return in aio_bind() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0505/1067] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0506/1067] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0507/1067] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0508/1067] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0509/1067] dmaengine: qcom: gpi: set DMA_PRIVATE capability Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0510/1067] dmaengine: Fix possible use after free Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0511/1067] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0512/1067] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0513/1067] xprtrdma: Remove temp allocation of rpcrdma_rep objects Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0514/1067] xprtrdma: Avoid 250 ms delay on backlog wakeup Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0515/1067] xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0516/1067] xprtrdma: Post receive buffers after RPC completion Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0517/1067] xprtrdma: Use sendctx DMA state for Send signaling Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0518/1067] xprtrdma: Decouple req recycling from RPC completion Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0519/1067] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0520/1067] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0521/1067] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0522/1067] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0523/1067] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0524/1067] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0525/1067] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0526/1067] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0527/1067] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0528/1067] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0529/1067] xprtrdma: Check frwr_wp_create() during connect Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0530/1067] xprtrdma: Document and assert reply-handler invariants Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0531/1067] xprtrdma: Resize reply buffers before reposting receives Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0532/1067] xprtrdma: Fix bcall rep leak and unbounded peek Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0533/1067] xprtrdma: Sanitize the reply credit grant after parsing Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0534/1067] xprtrdma: Repost Receive buffers for malformed replies Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0535/1067] xprtrdma: Return sendctx slot after Send preparation failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0536/1067] perf pmu: Fix pmu_id() heap underwrite on empty identifier file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0537/1067] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.1 0538/1067] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0539/1067] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0540/1067] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0541/1067] perf intel-pt: Fix snprintf size tracking bug in insn decoder Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0542/1067] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0543/1067] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0544/1067] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0545/1067] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0546/1067] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0547/1067] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0548/1067] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0549/1067] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0550/1067] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0551/1067] Revert "PCI/MSI: Unmap MSI-X region on error" Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0552/1067] security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0553/1067] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0554/1067] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0555/1067] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0556/1067] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0557/1067] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0558/1067] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0559/1067] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0560/1067] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0561/1067] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0562/1067] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0563/1067] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0564/1067] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0565/1067] perf bpf: Bounds-check array offsets in bpil_offs_to_addr() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0566/1067] spi: dw: fix wrong BAUDR setting after resume Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0567/1067] xfrm: add new packet offload flag Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0568/1067] xfrm: Use the XFRM_GRO to indicate a GRO call on input Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0569/1067] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0570/1067] xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0571/1067] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0572/1067] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0573/1067] ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0574/1067] drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0575/1067] drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0576/1067] drm/amdgpu: initialize irq.lock spinlock earlier Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0577/1067] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0578/1067] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0579/1067] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0580/1067] PCI: iproc: Restore .map_irq() for the platform bus driver Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0581/1067] spi: rpc-if: Use correct device for hardware reinitialization on resume Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0582/1067] virtio_ring: introduce virtqueue_set_dma_premapped() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0583/1067] virtio_ring: introduce dma map api for virtqueue Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0584/1067] virtio_ring: introduce dma sync " Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0585/1067] virtio-net: fix len check in receive_big() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0586/1067] dpaa2-switch: fix VLAN upper check not rejecting bridge join Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0587/1067] flow_dissector: check device type before reading ETH_ADDRS Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0588/1067] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0589/1067] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0590/1067] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0591/1067] ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0592/1067] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0593/1067] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0594/1067] md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0595/1067] netfilter: ipset: Fix data race between add and dump in all hash types Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0596/1067] netfilter: ipset: annotate "pos" for concurrent readers/writers Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0597/1067] netfilter: ipset: Dont use test_bit() in lockless RCU readers in hash types Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.1 0598/1067] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0599/1067] netfilter: nf_reject: skip iphdr options when looking for icmp header Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0600/1067] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0601/1067] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0602/1067] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0603/1067] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0604/1067] selftests/mm: fix exclusive_cow test fork() handling Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0605/1067] net: marvell: prestera: initialize err in prestera_port_sfp_bind Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0606/1067] octeontx2-af: mcs: Fix unsupported secy stats read Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0607/1067] octeontx2-pf: Clear stats of all resources when freeing resources Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0608/1067] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0609/1067] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0610/1067] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0611/1067] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0612/1067] bpf: zero-initialize the fib lookup flow struct Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0613/1067] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0614/1067] PCI: endpoint: pci-epf-vntb: Add check to detect db_count value of 0 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0615/1067] PCI: endpoint: pci-epf-ntb: " Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0616/1067] ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0617/1067] ice: fix AQ error code comparison in ice_set_pauseparam() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0618/1067] rtc: msc313: fix NULL deref in shared IRQ handler at probe Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0619/1067] ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0620/1067] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0621/1067] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0622/1067] bpf, lsm: Add disabled BPF LSM hook list Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0623/1067] bpf: Disable xfrm_decode_session hook attachment Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0624/1067] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0625/1067] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0626/1067] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0627/1067] NTB: epf: Make db_valid_mask cover only real doorbell bits Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0628/1067] NTB: epf: Report 0-based doorbell vector via ntb_db_event() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0629/1067] NTB: epf: Fix doorbell bitmask and IRQ vector handling Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0630/1067] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0631/1067] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0632/1067] net, bpf: check master for NULL in xdp_master_redirect() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0633/1067] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0634/1067] veth: fix NAPI leak in XDP enable error path Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0635/1067] net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0636/1067] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0637/1067] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0638/1067] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0639/1067] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0640/1067] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0641/1067] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0642/1067] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0643/1067] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0644/1067] net: sungem: fix probe error cleanup Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0645/1067] ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0646/1067] dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0647/1067] tracing: probes: fix typo in a log message Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0648/1067] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0649/1067] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0650/1067] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0651/1067] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0652/1067] qede: fix out-of-bounds check for cqe->len_list[] Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0653/1067] net: enetc: check the number of BDs needed for xdp_frame Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0654/1067] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0655/1067] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0656/1067] net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0657/1067] net: gianfar: dispose irq mappings on probe failure and device removal Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.1 0658/1067] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0659/1067] bridge: stp: Fix a potential use-after-free when deleting a bridge Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0660/1067] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0661/1067] tracing: eprobe: read the complete FILTER_PTR_STRING pointer Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0662/1067] irqchip/gic-v3-its: Fix OF node reference leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0663/1067] irqchip/ts4800: Fix missing chained handler cleanup on remove Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0664/1067] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0665/1067] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0666/1067] net/sched: act_bpf: use rcu_dereference_bh() to read the filter Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0667/1067] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0668/1067] pinctrl: meson: restore non-sleeping GPIO access Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0669/1067] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0670/1067] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0671/1067] afs: use kvfree() to free memory allocated by kvcalloc() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0672/1067] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0673/1067] afs: Fix vllist leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0674/1067] afs: Fix the volume AFS_VOLUME_RM_TREE is set on Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0675/1067] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0676/1067] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0677/1067] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0678/1067] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0679/1067] arm64/mm: convert ptep_clear() to ptep_get_and_clear() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0680/1067] arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0681/1067] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0682/1067] gue: validate REMCSUM private option length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0683/1067] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0684/1067] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0685/1067] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0686/1067] netfilter: xt_connmark: reject invalid shift parameters Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0687/1067] net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0688/1067] net/mlx5e: Fix HV VHCA stats agent registration race Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0689/1067] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0690/1067] net: qualcomm: rmnet: add tx packets aggregation Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0691/1067] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0692/1067] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0693/1067] amt: fix size calculation in amt_get_size() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0694/1067] Bluetooth: MGMT: Fix adv monitor add failure cleanup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0695/1067] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0696/1067] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0697/1067] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0698/1067] net: usb: lan78xx: move functions to avoid forward definitions Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0699/1067] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0700/1067] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0701/1067] octeontx2-pf: check DMAC extraction support before filtering Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0702/1067] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0703/1067] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0704/1067] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0705/1067] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0706/1067] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0707/1067] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0708/1067] cifs: validate DFS referral string offsets Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0709/1067] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0710/1067] regulator: core: Make regulator_lock_two() logic easier to follow Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0711/1067] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0712/1067] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0713/1067] octeontx2-af: fix VF bringup affecting PF promiscuous state Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0714/1067] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0715/1067] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0716/1067] vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0717/1067] ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.1 0718/1067] ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0719/1067] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0720/1067] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0721/1067] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0722/1067] arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0723/1067] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0724/1067] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0725/1067] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0726/1067] KVM: s390: pci: Fix handling of AIF enable without AISB Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0727/1067] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0728/1067] fbdev: metronomefb: fix potential memory leak in metronomefb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0729/1067] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0730/1067] fbdev: hecubafb: fix potential memory leak in hecubafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0731/1067] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0732/1067] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0733/1067] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0734/1067] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0735/1067] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0736/1067] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0737/1067] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0738/1067] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0739/1067] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0740/1067] ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0741/1067] ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0742/1067] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0743/1067] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0744/1067] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0745/1067] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0746/1067] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0747/1067] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0748/1067] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0749/1067] netfilter: ecache: fix inverted time_after() check Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0750/1067] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0751/1067] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0752/1067] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0753/1067] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0754/1067] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0755/1067] selinux: check connect-related permissions on TCP Fast Open Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0756/1067] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0757/1067] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0758/1067] tools/power/x86/intel-speed-select: Harden daemon pidfile open Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0759/1067] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0760/1067] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0761/1067] perf/x86/amd/lbr: Fix kernel address leakage Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0762/1067] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0763/1067] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0764/1067] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0765/1067] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0766/1067] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0767/1067] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0768/1067] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0769/1067] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0770/1067] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0771/1067] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0772/1067] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0773/1067] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0774/1067] Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0775/1067] Bluetooth: SCO: hold sk properly " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0776/1067] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0777/1067] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.1 0778/1067] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0779/1067] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0780/1067] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0781/1067] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0782/1067] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0783/1067] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0784/1067] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0785/1067] power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0786/1067] fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0787/1067] fs/ntfs3: bound DeleteIndexEntryAllocation memmove length Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0788/1067] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0789/1067] fs/ntfs3: bound attr_off in UpdateResidentValue against data_off Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0790/1067] fs/ntfs3: validate lcns_follow in log_replay conversion Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0791/1067] fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0792/1067] fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0793/1067] ntfs3: cap RESTART_TABLE free-chain walker at rt->used Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0794/1067] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0795/1067] ntfs3: fix out-of-bounds read in decompress_lznt Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0796/1067] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0797/1067] mips: sched: Fix CPUMASK_OFFSTACK memory corruption Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0798/1067] riscv: cacheinfo: Fix node reference leak in populate_cache_leaves Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0799/1067] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0800/1067] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0801/1067] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0802/1067] scsi: sas: Skip opt_sectors when DMA reports no real optimization hint Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0803/1067] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0804/1067] mtd: rawnand: pl353: fix probe resource allocation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0805/1067] net/9p: fix infinite loop in p9_client_rpc on fatal signal Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0806/1067] mtd: rawnand: fix condition in nand_select_target() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0807/1067] ocfs2: avoid moving extents to occupied clusters Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0808/1067] ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0809/1067] ocfs2: add journal NULL check in ocfs2_checkpoint_inode() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0810/1067] ocfs2: reject dinodes with non-canonical i_mode type Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0811/1067] ocfs2: reject dinodes whose i_rdev disagrees with the file type Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0812/1067] ocfs2: reject non-inline dinodes with i_size and zero i_clusters Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0813/1067] bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0814/1067] fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0815/1067] mtd: spi-nor: swp: Improve locking user experience Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0816/1067] mtd: maps: vmu-flash: fix NULL pointer dereference in initialization Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0817/1067] irqchip/crossbar: Use correct index in crossbar_domain_free() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0818/1067] tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0819/1067] dmaengine: tegra: Fix burst size calculation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0820/1067] dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0821/1067] smb: client: use kvzalloc() for megabyte buffer in simple fallocate Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0822/1067] ksmbd: fix integer overflow in set_file_allocation_info() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0823/1067] hwmon: (ltc2992) add missing select REGMAP_I2C to Kconfig Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0824/1067] i2c: mediatek: fix WRRD for SoCs without auto_restart option Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0825/1067] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0826/1067] xen/gntdev: fix error handling in ioctl Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0827/1067] xfrm: use compat translator only for u64 alignment mismatch Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0828/1067] xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0829/1067] tpm: fix event_size output in tpm1_binary_bios_measurements_show Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0830/1067] tpm: Make the TPM character devices non-seekable Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0831/1067] time: Fix off-by-one in compat settimeofday() usec validation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0832/1067] spi: uniphier: Fix completion initialization order before devm_request_irq() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0833/1067] sctp: validate STALE_COOKIE cause length before reading staleness Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0834/1067] nvmet-rdma: handle inline data with a nonzero offset Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0835/1067] can: esd_usb: kill anchored URBs before freeing netdevs Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0836/1067] can: isotp: use unconditional synchronize_rcu() in isotp_release() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0837/1067] can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.1 0838/1067] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0839/1067] can: bcm: add missing rcu list annotations and operations Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0840/1067] bpf: Add missing access_ok call to copy_user_syms Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0841/1067] net: sparx5: unregister blocking notifier on init failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0842/1067] dm thin metadata: fix superblock refcount leak on snapshot shadow failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0843/1067] dm thin metadata: fix metadata snapshot consistency on commit failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0844/1067] dm era: fix out-of-bounds memory access for non-zero start sector Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0845/1067] dm-bufio: fix wrong count calculation in dm_bufio_issue_discard Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0846/1067] dm-log: fix a bitset_size overflow on 32bit machines Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0847/1067] dm-stats: fix dm_jiffies_to_msec64 Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0848/1067] dm-stats: fix merge accounting Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0849/1067] dm_early_create: fix freeing used table on dm_resume failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0850/1067] dm-verity: fix a possible NULL pointer dereference Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0851/1067] dm-verity: increase sprintf buffer size Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0852/1067] scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0853/1067] scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0854/1067] scsi: sg: Report request-table problems when any status is set Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0855/1067] scsi: xen: scsiback: Free the command tag on the TMR submit-failure path Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0856/1067] scsi: xen: scsiback: Free unsubmitted command instead of double-putting it Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0857/1067] scsi: target: Bound PR-OUT TransportID parsing to the received buffer Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0858/1067] scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0859/1067] scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0860/1067] scsi: elx: efct: Fix I/O leak on unsupported additional CDB Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0861/1067] Input: ims-pcu - fix use-after-free and double-free in disconnect Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0862/1067] Input: ims-pcu - release data interface on disconnect Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0863/1067] Input: ims-pcu - validate control endpoint type Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0864/1067] Input: ims-pcu - add response length checks Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0865/1067] Input: ims-pcu - fix DMA mapping violation in line setup Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0866/1067] Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0867/1067] Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0868/1067] Input: ims-pcu - fix race condition in reset_device sysfs callback Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0869/1067] Input: ims-pcu - fix type confusion in CDC union descriptor parsing Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0870/1067] net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0871/1067] posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0872/1067] cpu: hotplug: Preserve per instance callback errors Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0873/1067] cpu: hotplug: Bound hotplug states sysfs output Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0874/1067] gpio-f7188x: Add support for NCT6126D version B Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0875/1067] gpios: palmas: add .get_direction() op Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0876/1067] net: sit: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0877/1067] net: wwan: t7xx: destroy DMA pool on CLDMA late init failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0878/1067] net: ixp4xx_hss: fix duplicate HDLC netdev allocation Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0879/1067] net: ena: clean up XDP TX queues when regular TX setup fails Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0880/1067] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0881/1067] net: ip_vti: " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0882/1067] net: ipip: " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0883/1067] net: ip6_gre: " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0884/1067] ieee802154: admin-gate legacy LLSEC dump operations Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0885/1067] ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0886/1067] ieee802154: ca8210: fix cas_ctl leak on spi_async failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0887/1067] ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0888/1067] net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0889/1067] mm/damon/reclaim: fix typo in damon_reclaim_timer_fn() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0890/1067] batman-adv: retrieve ethhdr after potential skb realloc on RX Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0891/1067] batman-adv: ensure minimal ethernet header on TX Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0892/1067] batman-adv: clean untagged VLAN on netdev registration failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0893/1067] LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0894/1067] bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0895/1067] rtc: mpfs: fix counter upload completion condition Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0896/1067] hwmon: (w83627hf) remove VID sysfs files on error and remove Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0897/1067] hwmon: (w83793) remove vrm sysfs file on probe failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 6.1 0898/1067] net: liquidio: fix BAR resource leak on PF number failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0899/1067] hwmon: (occ) unregister sysfs devices outside occ lock Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0900/1067] fsl/fman: Free init resources on KeyGen failure in fman_init() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0901/1067] net: lan743x: Initialize eth_syslock spinlock before use Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0902/1067] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0903/1067] tracing/probes: Fix double addition of offset for @+FOFFSET Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0904/1067] orangefs: keep the readdir entry size 64-bit in fill_from_part() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0905/1067] ata: pata_pxa: Fix DMA channel leak on probe error Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0906/1067] net: wwan: iosm: bound device offsets in the MUX downlink decoder Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0907/1067] hwmon: (asus_atk0110) Check package count before accessing element Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0908/1067] s390/monwriter: Reject buffer reuse with different data length Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0909/1067] mac802154: remove interfaces with RCU list deletion Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0910/1067] llc: fix SAP refcount leak in llc_ui_autobind() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0911/1067] ipvs: use parsed transport offset in SCTP state lookup Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0912/1067] ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0913/1067] macsec: dont read an unset MAC header in macsec_encrypt() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0914/1067] drbd: reject data replies with an out-of-range payload size Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0915/1067] riscv: Prevent NULL pointer dereference in machine_kexec_prepare() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0916/1067] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0917/1067] powerpc/pseries: fix memory leak on krealloc failure in papr_init Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0918/1067] wifi: rt2x00: avoid full teardown before work setup in probe Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0919/1067] wifi: mac80211: fix memory leak in ieee80211_register_hw() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0920/1067] regulator: ltc3676: Fix incorrect IRQSTAT bit offsets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0921/1067] net: openvswitch: reject oversized nested action attrs Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0922/1067] Bluetooth: btrtl: validate firmware patch bounds Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0923/1067] llc: fix SAP refcount leak when creating incoming sockets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0924/1067] macsec: fix promiscuity refcount leak in macsec_dev_open() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0925/1067] memstick: ms_block: reject a card that reports too many blocks Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0926/1067] ipvs: fix more places with wrong ipv6 transport offsets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0927/1067] reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0928/1067] reset: sunxi: fix memory region leak on ioremap failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0929/1067] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0930/1067] wifi: mac80211: free ack status frame on TX header build failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0931/1067] wifi: mwifiex: fix permanently busy scans after multiple roam iterations Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0932/1067] mtd: onenand: samsung: report DMA completion timeouts Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0933/1067] mtd: mchp23k256: use SPI match data for chip caps Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0934/1067] mmc: vub300: defer reset until cmd_mutex is unlocked Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0935/1067] mtd: rawnand: fsl_ifc: return errors for failed page reads Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0936/1067] mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0937/1067] mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0938/1067] perf/x86/amd/brs: Fix kernel address leakage Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0939/1067] ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0940/1067] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0941/1067] iio: hid-sensor-rotation: Fix stale or zero output when reading raw values Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0942/1067] iio: imu: inv_icm42600: make timestamp module chip independent Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0943/1067] iio: move inv_icm42600 timestamp module in common Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0944/1067] iio: make invensense timestamp module generic Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0945/1067] iio: imu: inv_mpu6050: use the common inv_sensors timestamp module Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0946/1067] iio: invensense: remove redundant initialization of variable period Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0947/1067] iio: invensense: fix timestamp glitches when switching frequency Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0948/1067] iio: imu: inv_icm42600: stabilized timestamp in interrupt Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0949/1067] iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0950/1067] ALSA: aoa: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0951/1067] bitops: make BYTES_TO_BITS() treewide-available Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0952/1067] iio: common: st_sensors: honour channel endianness in read_axis_data Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0953/1067] vfio/pci: Use bitfield for struct vfio_pci_core_device flags Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0954/1067] vfio/pci: Use a private flag to prevent power state change with VFs Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0955/1067] vfio/pci: Latch disable_idle_d3 per device Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0956/1067] PCI: altera: Fix resource leaks on probe failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0957/1067] vfio/mlx5: Fix racy bitfields and tighten struct layout Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 6.1 0958/1067] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0959/1067] staging: rtl8723bs: Fix indentation issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0960/1067] staging: rtl8723bs: Fix space issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0961/1067] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0962/1067] PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0963/1067] PCI: mediatek: Convert bool to single quirks entry and bitmap Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0964/1067] PCI: mediatek: Use generic MACRO for TPVPERL delay Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0965/1067] PCI: mediatek: Fix IRQ domain leak when port fails to enable Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0966/1067] staging: rtl8723bs: core: move constants to right side in comparison Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0967/1067] staging: rtl8723bs: fix spaces around binary operators Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0968/1067] staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0969/1067] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0970/1067] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0971/1067] PCI: Free saved list without holding pci_bus_sem Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0972/1067] PCI: Fix restoring BARs on BAR resize rollback path Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0973/1067] PCI: Add kerneldoc for pci_resize_resource() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0974/1067] PCI: Move Resizable BAR code to rebar.c Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0975/1067] PCI: Skip Resizable BAR restore on read error Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0976/1067] mm: shrinker: remove redundant shrinker_rwsem in debugfs operations Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0977/1067] mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0978/1067] coresight: etb10: restore atomic_t for shared reading state Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0979/1067] gpio: sch: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0980/1067] mm: shrinkers: fix debugfs file permissions Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0981/1067] mm: shrinker: fix NULL pointer dereference in debugfs Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0982/1067] netfilter: ebtables: Use vmalloc_array() to improve code Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0983/1067] netfilter: ebtables: zero chainstack array Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0984/1067] Bluetooth: Make handle of hci_conn be unique Greg Kroah-Hartman
2026-07-21 15:26 ` Greg Kroah-Hartman [this message]
2026-07-21 15:26 ` [PATCH 6.1 0986/1067] Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0987/1067] Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0988/1067] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0989/1067] Bluetooth: L2CAP: Fix not tracking outstanding TX ident Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0990/1067] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0991/1067] Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0992/1067] Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0993/1067] cifs: handle when server stops supporting multichannel Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0994/1067] cifs: after disabling multichannel, mark tcon for reconnect Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0995/1067] cifs: Fix reacquisition of volume cookie on still-live connection Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0996/1067] cifs: Add tracing for the cifs_tcon struct refcounting Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0997/1067] smb: client: resolve SWN tcon from live registrations Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0998/1067] ksmbd: use opener credentials for FSCTL mutations Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 6.1 0999/1067] smb: move some duplicate definitions to common/cifsglob.h Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260721152446.589799862@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=luiz.von.dentz@intel.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox