Skip to content

Commit a54b2e2

Browse files
kuba-mookuba-moo
committed
Merge tag 'for-net-2025-04-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - btmtksdio: Check function enabled before doing close - btmtksdio: Do close if SDIO card removed without close - btusb: avoid NULL pointer dereference in skb_dequeue() - btintel_pcie: Avoid redundant buffer allocation - btintel_pcie: Add additional to checks to clear TX/RX paths - hci_conn: Fix not setting conn_timeout for Broadcast Receiver - hci_conn: Fix not setting timeout for BIG Create Sync * tag 'for-net-2025-04-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: copy RX timestamp to new fragments Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths Bluetooth: btmtksdio: Do close if SDIO card removed without close Bluetooth: btmtksdio: Check function enabled before doing close Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() Bluetooth: btintel_pcie: Avoid redundant buffer allocation Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver ==================== Link: https://patch.msgid.link/20250425192412.1578759-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents 10c34b7 + 3908feb commit a54b2e2

File tree

11 files changed

+300
-272
lines changed

11 files changed

+300
-272
lines changed

‎drivers/bluetooth/btintel_pcie.c‎

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -957,8 +957,10 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
957957
/* This is a debug event that comes from IML and OP image when it
958958
* starts execution. There is no need pass this event to stack.
959959
*/
960-
if (skb->data[2] == 0x97)
960+
if (skb->data[2] == 0x97) {
961+
hci_recv_diag(hdev, skb);
961962
return 0;
963+
}
962964
}
963965

964966
return hci_recv_frame(hdev, skb);
@@ -974,7 +976,6 @@ static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
974976
u8 pkt_type;
975977
u16 plen;
976978
u32 pcie_pkt_type;
977-
struct sk_buff *new_skb;
978979
void *pdata;
979980
struct hci_dev *hdev = data->hdev;
980981

@@ -1051,24 +1052,20 @@ static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
10511052

10521053
bt_dev_dbg(hdev, "pkt_type: 0x%2.2x len: %u", pkt_type, plen);
10531054

1054-
new_skb = bt_skb_alloc(plen, GFP_ATOMIC);
1055-
if (!new_skb) {
1056-
bt_dev_err(hdev, "Failed to allocate memory for skb of len: %u",
1057-
skb->len);
1058-
ret = -ENOMEM;
1059-
goto exit_error;
1060-
}
1061-
1062-
hci_skb_pkt_type(new_skb) = pkt_type;
1063-
skb_put_data(new_skb, skb->data, plen);
1055+
hci_skb_pkt_type(skb) = pkt_type;
10641056
hdev->stat.byte_rx += plen;
1057+
skb_trim(skb, plen);
10651058

10661059
if (pcie_pkt_type == BTINTEL_PCIE_HCI_EVT_PKT)
1067-
ret = btintel_pcie_recv_event(hdev, new_skb);
1060+
ret = btintel_pcie_recv_event(hdev, skb);
10681061
else
1069-
ret = hci_recv_frame(hdev, new_skb);
1062+
ret = hci_recv_frame(hdev, skb);
1063+
skb = NULL; /* skb is freed in the callee */
10701064

10711065
exit_error:
1066+
if (skb)
1067+
kfree_skb(skb);
1068+
10721069
if (ret)
10731070
hdev->stat.err_rx++;
10741071

@@ -1202,8 +1199,6 @@ static void btintel_pcie_rx_work(struct work_struct *work)
12021199
struct btintel_pcie_data *data = container_of(work,
12031200
struct btintel_pcie_data, rx_work);
12041201
struct sk_buff *skb;
1205-
int err;
1206-
struct hci_dev *hdev = data->hdev;
12071202

12081203
if (test_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags)) {
12091204
/* Unlike usb products, controller will not send hardware
@@ -1224,11 +1219,7 @@ static void btintel_pcie_rx_work(struct work_struct *work)
12241219

12251220
/* Process the sk_buf in queue and send to the HCI layer */
12261221
while ((skb = skb_dequeue(&data->rx_skb_q))) {
1227-
err = btintel_pcie_recv_frame(data, skb);
1228-
if (err)
1229-
bt_dev_err(hdev, "Failed to send received frame: %d",
1230-
err);
1231-
kfree_skb(skb);
1222+
btintel_pcie_recv_frame(data, skb);
12321223
}
12331224
}
12341225

@@ -1281,10 +1272,8 @@ static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data *data)
12811272
bt_dev_dbg(hdev, "RXQ: cr_hia: %u cr_tia: %u", cr_hia, cr_tia);
12821273

12831274
/* Check CR_TIA and CR_HIA for change */
1284-
if (cr_tia == cr_hia) {
1285-
bt_dev_warn(hdev, "RXQ: no new CD found");
1275+
if (cr_tia == cr_hia)
12861276
return;
1287-
}
12881277

12891278
rxq = &data->rxq;
12901279

@@ -1320,6 +1309,16 @@ static irqreturn_t btintel_pcie_msix_isr(int irq, void *data)
13201309
return IRQ_WAKE_THREAD;
13211310
}
13221311

1312+
static inline bool btintel_pcie_is_rxq_empty(struct btintel_pcie_data *data)
1313+
{
1314+
return data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM] == data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM];
1315+
}
1316+
1317+
static inline bool btintel_pcie_is_txackq_empty(struct btintel_pcie_data *data)
1318+
{
1319+
return data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] == data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM];
1320+
}
1321+
13231322
static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
13241323
{
13251324
struct msix_entry *entry = dev_id;
@@ -1351,12 +1350,18 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
13511350
btintel_pcie_msix_gp0_handler(data);
13521351

13531352
/* For TX */
1354-
if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0)
1353+
if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0) {
13551354
btintel_pcie_msix_tx_handle(data);
1355+
if (!btintel_pcie_is_rxq_empty(data))
1356+
btintel_pcie_msix_rx_handle(data);
1357+
}
13561358

13571359
/* For RX */
1358-
if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1)
1360+
if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1) {
13591361
btintel_pcie_msix_rx_handle(data);
1362+
if (!btintel_pcie_is_txackq_empty(data))
1363+
btintel_pcie_msix_tx_handle(data);
1364+
}
13601365

13611366
/*
13621367
* Before sending the interrupt the HW disables it to prevent a nested

‎drivers/bluetooth/btmtksdio.c‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -723,6 +723,10 @@ static int btmtksdio_close(struct hci_dev *hdev)
723723
{
724724
struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
725725

726+
/* Skip btmtksdio_close if BTMTKSDIO_FUNC_ENABLED isn't set */
727+
if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
728+
return 0;
729+
726730
sdio_claim_host(bdev->func);
727731

728732
/* Disable interrupt */
@@ -1443,11 +1447,15 @@ static void btmtksdio_remove(struct sdio_func *func)
14431447
if (!bdev)
14441448
return;
14451449

1450+
hdev = bdev->hdev;
1451+
1452+
/* Make sure to call btmtksdio_close before removing sdio card */
1453+
if (test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
1454+
btmtksdio_close(hdev);
1455+
14461456
/* Be consistent the state in btmtksdio_probe */
14471457
pm_runtime_get_noresume(bdev->dev);
14481458

1449-
hdev = bdev->hdev;
1450-
14511459
sdio_set_drvdata(func, NULL);
14521460
hci_unregister_dev(hdev);
14531461
hci_free_dev(hdev);

‎drivers/bluetooth/btusb.c‎

Lines changed: 73 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3010,22 +3010,16 @@ static void btusb_coredump_qca(struct hci_dev *hdev)
30103010
bt_dev_err(hdev, "%s: triggle crash failed (%d)", __func__, err);
30113011
}
30123012

3013-
/*
3014-
* ==0: not a dump pkt.
3015-
* < 0: fails to handle a dump pkt
3016-
* > 0: otherwise.
3017-
*/
3013+
/* Return: 0 on success, negative errno on failure. */
30183014
static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30193015
{
3020-
int ret = 1;
3016+
int ret = 0;
30213017
u8 pkt_type;
30223018
u8 *sk_ptr;
30233019
unsigned int sk_len;
30243020
u16 seqno;
30253021
u32 dump_size;
30263022

3027-
struct hci_event_hdr *event_hdr;
3028-
struct hci_acl_hdr *acl_hdr;
30293023
struct qca_dump_hdr *dump_hdr;
30303024
struct btusb_data *btdata = hci_get_drvdata(hdev);
30313025
struct usb_device *udev = btdata->udev;
@@ -3035,30 +3029,14 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30353029
sk_len = skb->len;
30363030

30373031
if (pkt_type == HCI_ACLDATA_PKT) {
3038-
acl_hdr = hci_acl_hdr(skb);
3039-
if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE)
3040-
return 0;
30413032
sk_ptr += HCI_ACL_HDR_SIZE;
30423033
sk_len -= HCI_ACL_HDR_SIZE;
3043-
event_hdr = (struct hci_event_hdr *)sk_ptr;
3044-
} else {
3045-
event_hdr = hci_event_hdr(skb);
30463034
}
30473035

3048-
if ((event_hdr->evt != HCI_VENDOR_PKT)
3049-
|| (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3050-
return 0;
3051-
30523036
sk_ptr += HCI_EVENT_HDR_SIZE;
30533037
sk_len -= HCI_EVENT_HDR_SIZE;
30543038

30553039
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3056-
if ((sk_len < offsetof(struct qca_dump_hdr, data))
3057-
|| (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS)
3058-
|| (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3059-
return 0;
3060-
3061-
/*it is dump pkt now*/
30623040
seqno = le16_to_cpu(dump_hdr->seqno);
30633041
if (seqno == 0) {
30643042
set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
@@ -3132,17 +3110,84 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
31323110
return ret;
31333111
}
31343112

3113+
/* Return: true if the ACL packet is a dump packet, false otherwise. */
3114+
static bool acl_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
3115+
{
3116+
u8 *sk_ptr;
3117+
unsigned int sk_len;
3118+
3119+
struct hci_event_hdr *event_hdr;
3120+
struct hci_acl_hdr *acl_hdr;
3121+
struct qca_dump_hdr *dump_hdr;
3122+
3123+
sk_ptr = skb->data;
3124+
sk_len = skb->len;
3125+
3126+
acl_hdr = hci_acl_hdr(skb);
3127+
if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE)
3128+
return false;
3129+
3130+
sk_ptr += HCI_ACL_HDR_SIZE;
3131+
sk_len -= HCI_ACL_HDR_SIZE;
3132+
event_hdr = (struct hci_event_hdr *)sk_ptr;
3133+
3134+
if ((event_hdr->evt != HCI_VENDOR_PKT) ||
3135+
(event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3136+
return false;
3137+
3138+
sk_ptr += HCI_EVENT_HDR_SIZE;
3139+
sk_len -= HCI_EVENT_HDR_SIZE;
3140+
3141+
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3142+
if ((sk_len < offsetof(struct qca_dump_hdr, data)) ||
3143+
(dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3144+
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3145+
return false;
3146+
3147+
return true;
3148+
}
3149+
3150+
/* Return: true if the event packet is a dump packet, false otherwise. */
3151+
static bool evt_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
3152+
{
3153+
u8 *sk_ptr;
3154+
unsigned int sk_len;
3155+
3156+
struct hci_event_hdr *event_hdr;
3157+
struct qca_dump_hdr *dump_hdr;
3158+
3159+
sk_ptr = skb->data;
3160+
sk_len = skb->len;
3161+
3162+
event_hdr = hci_event_hdr(skb);
3163+
3164+
if ((event_hdr->evt != HCI_VENDOR_PKT)
3165+
|| (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3166+
return false;
3167+
3168+
sk_ptr += HCI_EVENT_HDR_SIZE;
3169+
sk_len -= HCI_EVENT_HDR_SIZE;
3170+
3171+
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3172+
if ((sk_len < offsetof(struct qca_dump_hdr, data)) ||
3173+
(dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3174+
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3175+
return false;
3176+
3177+
return true;
3178+
}
3179+
31353180
static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb)
31363181
{
3137-
if (handle_dump_pkt_qca(hdev, skb))
3138-
return 0;
3182+
if (acl_pkt_is_dump_qca(hdev, skb))
3183+
return handle_dump_pkt_qca(hdev, skb);
31393184
return hci_recv_frame(hdev, skb);
31403185
}
31413186

31423187
static int btusb_recv_evt_qca(struct hci_dev *hdev, struct sk_buff *skb)
31433188
{
3144-
if (handle_dump_pkt_qca(hdev, skb))
3145-
return 0;
3189+
if (evt_pkt_is_dump_qca(hdev, skb))
3190+
return handle_dump_pkt_qca(hdev, skb);
31463191
return hci_recv_frame(hdev, skb);
31473192
}
31483193

‎include/net/bluetooth/hci.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1931,6 +1931,8 @@ struct hci_cp_le_pa_create_sync {
19311931
__u8 sync_cte_type;
19321932
} __packed;
19331933

1934+
#define HCI_OP_LE_PA_CREATE_SYNC_CANCEL 0x2045
1935+
19341936
#define HCI_OP_LE_PA_TERM_SYNC 0x2046
19351937
struct hci_cp_le_pa_term_sync {
19361938
__le16 handle;
@@ -2830,7 +2832,7 @@ struct hci_evt_le_create_big_complete {
28302832
__le16 bis_handle[];
28312833
} __packed;
28322834

2833-
#define HCI_EVT_LE_BIG_SYNC_ESTABILISHED 0x1d
2835+
#define HCI_EVT_LE_BIG_SYNC_ESTABLISHED 0x1d
28342836
struct hci_evt_le_big_sync_estabilished {
28352837
__u8 status;
28362838
__u8 handle;

‎include/net/bluetooth/hci_core.h‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1113,19 +1113,19 @@ static inline struct hci_conn *hci_conn_hash_lookup_bis(struct hci_dev *hdev,
11131113
return NULL;
11141114
}
11151115

1116-
static inline struct hci_conn *hci_conn_hash_lookup_sid(struct hci_dev *hdev,
1117-
__u8 sid,
1118-
bdaddr_t *dst,
1119-
__u8 dst_type)
1116+
static inline struct hci_conn *
1117+
hci_conn_hash_lookup_create_pa_sync(struct hci_dev *hdev)
11201118
{
11211119
struct hci_conn_hash *h = &hdev->conn_hash;
11221120
struct hci_conn *c;
11231121

11241122
rcu_read_lock();
11251123

11261124
list_for_each_entry_rcu(c, &h->list, list) {
1127-
if (c->type != ISO_LINK || bacmp(&c->dst, dst) ||
1128-
c->dst_type != dst_type || c->sid != sid)
1125+
if (c->type != ISO_LINK)
1126+
continue;
1127+
1128+
if (!test_bit(HCI_CONN_CREATE_PA_SYNC, &c->flags))
11291129
continue;
11301130

11311131
rcu_read_unlock();
@@ -1524,8 +1524,6 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle);
15241524
void hci_sco_setup(struct hci_conn *conn, __u8 status);
15251525
bool hci_iso_setup_path(struct hci_conn *conn);
15261526
int hci_le_create_cis_pending(struct hci_dev *hdev);
1527-
int hci_pa_create_sync_pending(struct hci_dev *hdev);
1528-
int hci_le_big_create_sync_pending(struct hci_dev *hdev);
15291527
int hci_conn_check_create_cis(struct hci_conn *conn);
15301528

15311529
struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
@@ -1566,9 +1564,9 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
15661564
__u8 data_len, __u8 *data);
15671565
struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
15681566
__u8 dst_type, __u8 sid, struct bt_iso_qos *qos);
1569-
int hci_le_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
1570-
struct bt_iso_qos *qos,
1571-
__u16 sync_handle, __u8 num_bis, __u8 bis[]);
1567+
int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
1568+
struct bt_iso_qos *qos, __u16 sync_handle,
1569+
__u8 num_bis, __u8 bis[]);
15721570
int hci_conn_check_link_mode(struct hci_conn *conn);
15731571
int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
15741572
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,

‎include/net/bluetooth/hci_sync.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,3 +185,6 @@ int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn);
185185
int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn);
186186
int hci_le_conn_update_sync(struct hci_dev *hdev, struct hci_conn *conn,
187187
struct hci_conn_params *params);
188+
189+
int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn);
190+
int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn);

0 commit comments

Comments
 (0)