Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_ll: Fix firmware leak on error path
- hci_sync: annotate data-races around hdev->req_status
- L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
- L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
- L2CAP: Fix regressions caused by reusing ident
- L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
- MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
* tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Bluetooth: hci_ll: Fix firmware leak on error path
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
====================
Link: https://patch.msgid.link/20260319190455.135302-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+60
-22
+2
drivers/bluetooth/hci_ll.c
+2
drivers/bluetooth/hci_ll.c
+1
include/net/bluetooth/l2cap.h
+1
include/net/bluetooth/l2cap.h
+1
-1
net/bluetooth/hci_conn.c
+1
-1
net/bluetooth/hci_conn.c
···
3095
3095
* hci_connect_le serializes the connection attempts so only one
3096
3096
* connection can be in BT_CONNECT at time.
3097
3097
*/
3098
-
if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
3098
+
if (conn->state == BT_CONNECT && READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
3099
3099
switch (hci_skb_event(hdev->sent_cmd)) {
3100
3100
case HCI_EV_CONN_COMPLETE:
3101
3101
case HCI_EV_LE_CONN_COMPLETE:
+1
-1
net/bluetooth/hci_core.c
+1
-1
net/bluetooth/hci_core.c
···
4126
4126
kfree_skb(skb);
4127
4127
}
4128
4128
4129
-
if (hdev->req_status == HCI_REQ_PEND &&
4129
+
if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND &&
4130
4130
!hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
4131
4131
kfree_skb(hdev->req_skb);
4132
4132
hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
+10
-10
net/bluetooth/hci_sync.c
+10
-10
net/bluetooth/hci_sync.c
···
25
25
{
26
26
bt_dev_dbg(hdev, "result 0x%2.2x", result);
27
27
28
-
if (hdev->req_status != HCI_REQ_PEND)
28
+
if (READ_ONCE(hdev->req_status) != HCI_REQ_PEND)
29
29
return;
30
30
31
31
hdev->req_result = result;
32
-
hdev->req_status = HCI_REQ_DONE;
32
+
WRITE_ONCE(hdev->req_status, HCI_REQ_DONE);
33
33
34
34
/* Free the request command so it is not used as response */
35
35
kfree_skb(hdev->req_skb);
···
167
167
168
168
hci_cmd_sync_add(&req, opcode, plen, param, event, sk);
169
169
170
-
hdev->req_status = HCI_REQ_PEND;
170
+
WRITE_ONCE(hdev->req_status, HCI_REQ_PEND);
171
171
172
172
err = hci_req_sync_run(&req);
173
173
if (err < 0)
174
174
return ERR_PTR(err);
175
175
176
176
err = wait_event_interruptible_timeout(hdev->req_wait_q,
177
-
hdev->req_status != HCI_REQ_PEND,
177
+
READ_ONCE(hdev->req_status) != HCI_REQ_PEND,
178
178
timeout);
179
179
180
180
if (err == -ERESTARTSYS)
181
181
return ERR_PTR(-EINTR);
182
182
183
-
switch (hdev->req_status) {
183
+
switch (READ_ONCE(hdev->req_status)) {
184
184
case HCI_REQ_DONE:
185
185
err = -bt_to_errno(hdev->req_result);
186
186
break;
···
194
194
break;
195
195
}
196
196
197
-
hdev->req_status = 0;
197
+
WRITE_ONCE(hdev->req_status, 0);
198
198
hdev->req_result = 0;
199
199
skb = hdev->req_rsp;
200
200
hdev->req_rsp = NULL;
···
665
665
{
666
666
bt_dev_dbg(hdev, "err 0x%2.2x", err);
667
667
668
-
if (hdev->req_status == HCI_REQ_PEND) {
668
+
if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
669
669
hdev->req_result = err;
670
-
hdev->req_status = HCI_REQ_CANCELED;
670
+
WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED);
671
671
672
672
queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
673
673
}
···
683
683
{
684
684
bt_dev_dbg(hdev, "err 0x%2.2x", err);
685
685
686
-
if (hdev->req_status == HCI_REQ_PEND) {
686
+
if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
687
687
/* req_result is __u32 so error must be positive to be properly
688
688
* propagated.
689
689
*/
690
690
hdev->req_result = err < 0 ? -err : err;
691
-
hdev->req_status = HCI_REQ_CANCELED;
691
+
WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED);
692
692
693
693
wake_up_interruptible(&hdev->req_wait_q);
694
694
}
+34
-6
net/bluetooth/l2cap_core.c
+34
-6
net/bluetooth/l2cap_core.c
···
926
926
927
927
static int l2cap_get_ident(struct l2cap_conn *conn)
928
928
{
929
+
u8 max;
930
+
int ident;
931
+
929
932
/* LE link does not support tools like l2ping so use the full range */
930
933
if (conn->hcon->type == LE_LINK)
931
-
return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
932
-
934
+
max = 255;
933
935
/* Get next available identificator.
934
936
* 1 - 128 are used by kernel.
935
937
* 129 - 199 are reserved.
936
938
* 200 - 254 are used by utilities like l2ping, etc.
937
939
*/
938
-
return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
940
+
else
941
+
max = 128;
942
+
943
+
/* Allocate ident using min as last used + 1 (cyclic) */
944
+
ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
945
+
max, GFP_ATOMIC);
946
+
/* Force min 1 to start over */
947
+
if (ident <= 0) {
948
+
ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
949
+
if (ident <= 0) {
950
+
/* If all idents are in use, log an error, this is
951
+
* extremely unlikely to happen and would indicate a bug
952
+
* in the code that idents are not being freed properly.
953
+
*/
954
+
BT_ERR("Unable to allocate ident: %d", ident);
955
+
return 0;
956
+
}
957
+
}
958
+
959
+
WRITE_ONCE(conn->tx_ident, ident);
960
+
961
+
return ident;
939
962
}
940
963
941
964
static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
···
5104
5081
cmd_len -= sizeof(*req);
5105
5082
num_scid = cmd_len / sizeof(u16);
5106
5083
5107
-
/* Always respond with the same number of scids as in the request */
5108
-
rsp_len = cmd_len;
5109
-
5110
5084
if (num_scid > L2CAP_ECRED_MAX_CID) {
5111
5085
result = L2CAP_CR_LE_INVALID_PARAMS;
5112
5086
goto response;
5113
5087
}
5088
+
5089
+
/* Always respond with the same number of scids as in the request */
5090
+
rsp_len = cmd_len;
5114
5091
5115
5092
mtu = __le16_to_cpu(req->mtu);
5116
5093
mps = __le16_to_cpu(req->mps);
···
6712
6689
6713
6690
if (!chan->sdu) {
6714
6691
u16 sdu_len;
6692
+
6693
+
if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
6694
+
err = -EINVAL;
6695
+
goto failed;
6696
+
}
6715
6697
6716
6698
sdu_len = get_unaligned_le16(skb->data);
6717
6699
skb_pull(skb, L2CAP_SDULEN_SIZE);
+3
net/bluetooth/l2cap_sock.c
+3
net/bluetooth/l2cap_sock.c
+1
-1
net/bluetooth/mgmt.c
+1
-1
net/bluetooth/mgmt.c
···
5355
5355
* hci_adv_monitors_clear is about to be called which will take care of
5356
5356
* freeing the adv_monitor instances.
5357
5357
*/
5358
-
if (status == -ECANCELED && !mgmt_pending_valid(hdev, cmd))
5358
+
if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
5359
5359
return;
5360
5360
5361
5361
monitor = cmd->user_data;
+7
-3
net/bluetooth/sco.c
+7
-3
net/bluetooth/sco.c
···
401
401
struct sock *sk;
402
402
403
403
sco_conn_lock(conn);
404
-
sk = conn->sk;
404
+
sk = sco_sock_hold(conn);
405
405
sco_conn_unlock(conn);
406
406
407
407
if (!sk)
···
410
410
BT_DBG("sk %p len %u", sk, skb->len);
411
411
412
412
if (sk->sk_state != BT_CONNECTED)
413
-
goto drop;
413
+
goto drop_put;
414
414
415
-
if (!sock_queue_rcv_skb(sk, skb))
415
+
if (!sock_queue_rcv_skb(sk, skb)) {
416
+
sock_put(sk);
416
417
return;
418
+
}
417
419
420
+
drop_put:
421
+
sock_put(sk);
418
422
drop:
419
423
kfree_skb(skb);
420
424
}