Commit 9767870e authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-net-2025-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - btrtl: Prevent potential NULL dereference
 - qca: fix NV variant for one of WCN3950 SoCs
 - l2cap: Check encryption key size on incoming connection
 - hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
 - btnxpuart: Revert baudrate change in nxp_shutdown
 - btnxpuart: Add an error message if FW dump trigger fails
 - increment TX timestamping tskey always for stream sockets

* tag 'for-net-2025-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: l2cap: Check encryption key size on incoming connection
  Bluetooth: btnxpuart: Add an error message if FW dump trigger fails
  Bluetooth: btnxpuart: Revert baudrate change in nxp_shutdown
  Bluetooth: increment TX timestamping tskey always for stream sockets
  Bluetooth: qca: fix NV variant for one of WCN3950 SoCs
  Bluetooth: btrtl: Prevent potential NULL dereference
  Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
====================

Link: https://patch.msgid.link/20250410173542.625232-1-luiz.dentz@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 18c889a9 522e9ed1

drivers/bluetooth/btnxpuart.c

+11 −10
Original line number Diff line number Diff line
@@ -1286,7 +1286,9 @@ static void nxp_coredump(struct hci_dev *hdev) 
	u8 pcmd = 2;



	skb = nxp_drv_send_cmd(hdev, HCI_NXP_TRIGGER_DUMP, 1, &pcmd);

	if (!IS_ERR(skb))

	if (IS_ERR(skb))

		bt_dev_err(hdev, "Failed to trigger FW Dump. (%ld)", PTR_ERR(skb));

	else

		kfree_skb(skb);

}
@@ -1445,9 +1447,6 @@ static int nxp_shutdown(struct hci_dev *hdev) 
		/* HCI_NXP_IND_RESET command may not returns any response */

		if (!IS_ERR(skb))

			kfree_skb(skb);

	} else if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {

		nxpdev->new_baudrate = nxpdev->fw_init_baudrate;

		nxp_set_baudrate_cmd(hdev, NULL);

	}



	return 0;
@@ -1799,13 +1798,15 @@ static void nxp_serdev_remove(struct serdev_device *serdev) 
		clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);

		wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);

		wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);

	}



	if (test_bit(HCI_RUNNING, &hdev->flags)) {

		/* Ensure shutdown callback is executed before unregistering, so

		 * that baudrate is reset to initial value.

	} else {

		/* Restore FW baudrate to fw_init_baudrate if changed.

		 * This will ensure FW baudrate is in sync with

		 * driver baudrate in case this driver is re-inserted.

		 */

		nxp_shutdown(hdev);

		if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {

			nxpdev->new_baudrate = nxpdev->fw_init_baudrate;

			nxp_set_baudrate_cmd(hdev, NULL);

		}

	}



	ps_cleanup(nxpdev);

drivers/bluetooth/btqca.c

+1 −1
Original line number Diff line number Diff line
@@ -889,7 +889,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, 
			if (le32_to_cpu(ver.soc_id) == QCA_WCN3950_SOC_ID_T)

				variant = "t";

			else if (le32_to_cpu(ver.soc_id) == QCA_WCN3950_SOC_ID_S)

				variant = "u";

				variant = "s";



			snprintf(config.fwname, sizeof(config.fwname),

				 "qca/cmnv%02x%s.bin", rom_ver, variant);

drivers/bluetooth/btrtl.c

+2 −0
Original line number Diff line number Diff line
@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 
			rtl_dev_err(hdev, "mandatory config file %s not found",

				    btrtl_dev->ic_info->cfg_name);

			ret = btrtl_dev->cfg_len;

			if (!ret)

				ret = -EINVAL;

			goto err_free;

		}

	}

net/bluetooth/hci_conn.c

+6 −2
Original line number Diff line number Diff line
@@ -3072,6 +3072,7 @@ void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset, 
			    const struct sockcm_cookie *sockc)

{

	struct sock *sk = skb ? skb->sk : NULL;

	int key;



	/* This shall be called on a single skb of those generated by user

	 * sendmsg(), and only when the sendmsg() does not return error to
@@ -3087,13 +3088,16 @@ void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset, 


	sock_tx_timestamp(sk, sockc, &skb_shinfo(skb)->tx_flags);



	if (sk->sk_type == SOCK_STREAM)

		key = atomic_add_return(key_offset, &sk->sk_tskey);



	if (sockc->tsflags & SOF_TIMESTAMPING_OPT_ID &&

	    sockc->tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK) {

		if (sockc->tsflags & SOCKCM_FLAG_TS_OPT_ID) {

			skb_shinfo(skb)->tskey = sockc->ts_opt_id;

		} else {

			int key = atomic_add_return(key_offset, &sk->sk_tskey);



			if (sk->sk_type != SOCK_STREAM)

				key = atomic_inc_return(&sk->sk_tskey);

			skb_shinfo(skb)->tskey = key - 1;

		}

	}

net/bluetooth/hci_event.c

+3 −2
Original line number Diff line number Diff line
@@ -6160,11 +6160,12 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, 
	 * event or send an immediate device found event if the data

	 * should not be stored for later.

	 */

	if (!ext_adv &&	!has_pending_adv_report(hdev)) {

	if (!has_pending_adv_report(hdev)) {

		/* If the report will trigger a SCAN_REQ store it for

		 * later merging.

		 */

		if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {

		if (!ext_adv && (type == LE_ADV_IND ||

				 type == LE_ADV_SCAN_IND)) {

			store_pending_adv_report(hdev, bdaddr, bdaddr_type,

						 rssi, flags, data, len);

			return;