Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:19:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'for-net-2026-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Browse Source 
Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

Core:

 - hci_sysfs: Fix NULL pointer dereference in device_del()
 - hci_sync: Fix not setting CE length properly
 - btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Drivers:

 - btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
 - btusb: mediatek: Fix leaked runtime PM reference in reset
 - btusb: Fix leaked runtime PM reference in btusb_reset
 - btusb: Fix UAF of btusb_data by rx_work
 - btusb: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
 - btintel_pcie: validate packet_len before skb_put_data
 - btintel_pcie: fix tx_handle bounds off-by-one
 - btrtl: Don't leak return code when parsing firmware format v2

* tag 'for-net-2026-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset
  Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset
  Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
  Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
  Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
  Bluetooth: hci_sync: Fix not setting CE length properly
  Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
  Bluetooth: btintel_pcie: validate packet_len before skb_put_data
  Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
  Bluetooth: btusb: Fix UAF of btusb_data by rx_work
  Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
====================

Link: https://patch.msgid.link/20260908212127.1022197-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
2026-09-09 12:51:52 -07:00
parent a401a9d547 c93922dd31
commit bbee0759d3
8 changed files with 159 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/hci_sync.c
+36 -2
View File
@@ -4797,6 +4797,24 @@ static int hci_le_set_def_rate_sync(struct hci_dev *hdev)
cp.cont_num = cpu_to_le16(0x0001);
cp.supv_timeout = cpu_to_le16(0x000c); /* 120 ms */
/* The connection event length recommended in requests by a Peripheral
* uses units of 125 us with a valid range of 0x0001 to 0x7CFF
* (0.125 ms to 3.999875 s), so 0x0000 cannot be used. Also note that
* the Controller is not required to use these values:
*
* BLUETOOTH CORE SPECIFICATION Version 6.2 | Vol 4, Part E
* 7.8.158. LE Set Default Rate Parameters command
*
* The Min_CE_Length and Max_CE_Length parameters provide the
* Controller with the expected minimum and maximum length of the
* connection events. The Controller is not required to use these
* values.
*
* So it is safe to just use the minimum.
*/
cp.min_ce_len = cpu_to_le16(0x0001);
cp.max_ce_len = cpu_to_le16(0x0001);
return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEF_RATE,
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
@@ -7467,8 +7485,24 @@ static int hci_le_conn_rate_request_sync(struct hci_dev *hdev, void *data)
cp.max_latency = cpu_to_le16(params->max_latency);
cp.cont_num = cpu_to_le16(params->cont_num);
cp.supv_timeout = cpu_to_le16(params->rate_supv_timeout);
cp.min_ce_len = cpu_to_le16(0x0000);
cp.max_ce_len = cpu_to_le16(0x0000);
/* The connection event length recommended in requests by a Peripheral
* uses units of 125 us with a valid range of 0x0001 to 0x7CFF
* (0.125 ms to 3.999875 s), so 0x0000 cannot be used. Also note that
* the Controller is not required to use these values:
*
* BLUETOOTH CORE SPECIFICATION Version 6.2 | Vol 4, Part E
* 7.8.157. LE Connection Rate Request command
*
* The Min_CE_Length and Max_CE_Length parameters provide the
* Controller with the expected minimum and maximum length of the
* connection events. The Controller is not required to use these
* values.
*
* So it is safe to just use the minimum.
*/
cp.min_ce_len = cpu_to_le16(0x0001);
cp.max_ce_len = cpu_to_le16(0x0001);
hci_dev_unlock(hdev);
net/bluetooth/hci_sysfs.c
+15 -2
View File
@@ -13,7 +13,10 @@ static const struct class bt_class = {
static void bt_link_release(struct device *dev)
{
struct hci_conn *conn = to_hci_conn(dev);
struct device *parent = dev->parent;
kfree(conn);
put_device(parent);
}
static const struct device_type bt_link = {
@@ -21,6 +24,16 @@ static const struct device_type bt_link = {
.release = bt_link_release,
};
/*
* The rfcomm tty device will possibly retain even when conn
* is down, and sysfs doesn't support move zombie device,
* so we should move the device before conn device is destroyed.
*/
static int __match_tty(struct device *dev, const void *data)
{
return !strncmp(dev_name(dev), "rfcomm", 6);
}
void hci_conn_init_sysfs(struct hci_conn *conn)
{
struct hci_dev *hdev = conn->hdev;
@@ -29,7 +42,7 @@ void hci_conn_init_sysfs(struct hci_conn *conn)
conn->dev.type = &bt_link;
conn->dev.class = &bt_class;
conn->dev.parent = &hdev->dev;
conn->dev.parent = get_device(&hdev->dev);
device_initialize(&conn->dev);
}
@@ -69,7 +82,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
while (1) {
struct device *dev;
dev = device_find_any_child(&conn->dev);
dev = device_find_child(&conn->dev, NULL, __match_tty);
if (!dev)
break;
device_move(dev, NULL, DPM_ORDER_DEV_LAST);