Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- fix corruption in h4_recv_buf() after cleanupCen Zhang (1):
- hci_sync: fix race in hci_cmd_sync_dequeue_once
- btmtksdio: Add pmctrl handling for BT closed state during reset
- Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()"
- rfcomm: fix modem control handling
- btintel_pcie: Fix event packet loss issue
- ISO: Fix BIS connection dst_type handling
- HCI: Fix tracking of advertisement set/instance 0x00
- ISO: Fix another instance of dst_type handling
- hci_conn: Fix connection cleanup with BIG with 2 or more BIS
- hci_core: Fix tracking of periodic advertisement
- MGMT: fix crash in set_mesh_sync and set_mesh_complete
* tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: rfcomm: fix modem control handling
Bluetooth: hci_core: Fix tracking of periodic advertisement
Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS
Bluetooth: fix corruption in h4_recv_buf() after cleanup
Bluetooth: btintel_pcie: Fix event packet loss issue
Bluetooth: ISO: Fix another instance of dst_type handling
Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()"
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
Bluetooth: ISO: Fix BIS connection dst_type handling
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
====================
Link: https://patch.msgid.link/20251024144033.355820-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+114
-68
+3
-1
drivers/bluetooth/bpa10x.c
+3
-1
drivers/bluetooth/bpa10x.c
···
41
41
struct usb_anchor rx_anchor;
42
42
43
43
struct sk_buff *rx_skb[2];
44
+
struct hci_uart hu;
44
45
};
45
46
46
47
static void bpa10x_tx_complete(struct urb *urb)
···
97
96
if (urb->status == 0) {
98
97
bool idx = usb_pipebulk(urb->pipe);
99
98
100
-
data->rx_skb[idx] = h4_recv_buf(hdev, data->rx_skb[idx],
99
+
data->rx_skb[idx] = h4_recv_buf(&data->hu, data->rx_skb[idx],
101
100
urb->transfer_buffer,
102
101
urb->actual_length,
103
102
bpa10x_recv_pkts,
···
389
388
hci_set_drvdata(hdev, data);
390
389
391
390
data->hdev = hdev;
391
+
data->hu.hdev = hdev;
392
392
393
393
SET_HCIDEV_DEV(hdev, &intf->dev);
394
394
+6
-5
drivers/bluetooth/btintel_pcie.c
+6
-5
drivers/bluetooth/btintel_pcie.c
···
1467
1467
if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP1)
1468
1468
btintel_pcie_msix_gp1_handler(data);
1469
1469
1470
-
/* This interrupt is triggered by the firmware after updating
1471
-
* boot_stage register and image_response register
1472
-
*/
1473
-
if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0)
1474
-
btintel_pcie_msix_gp0_handler(data);
1475
1470
1476
1471
/* For TX */
1477
1472
if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0) {
···
1481
1486
if (!btintel_pcie_is_txackq_empty(data))
1482
1487
btintel_pcie_msix_tx_handle(data);
1483
1488
}
1489
+
1490
+
/* This interrupt is triggered by the firmware after updating
1491
+
* boot_stage register and image_response register
1492
+
*/
1493
+
if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0)
1494
+
btintel_pcie_msix_gp0_handler(data);
1484
1495
1485
1496
/*
1486
1497
* Before sending the interrupt the HW disables it to prevent a nested
+12
drivers/bluetooth/btmtksdio.c
+12
drivers/bluetooth/btmtksdio.c
···
1270
1270
1271
1271
sdio_claim_host(bdev->func);
1272
1272
1273
+
/* set drv_pmctrl if BT is closed before doing reset */
1274
+
if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
1275
+
sdio_enable_func(bdev->func);
1276
+
btmtksdio_drv_pmctrl(bdev);
1277
+
}
1278
+
1273
1279
sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
1274
1280
skb_queue_purge(&bdev->txq);
1275
1281
cancel_work_sync(&bdev->txrx_work);
···
1289
1283
if (err < 0) {
1290
1284
bt_dev_err(hdev, "Failed to reset (%d)", err);
1291
1285
goto err;
1286
+
}
1287
+
1288
+
/* set fw_pmctrl back if BT is closed after doing reset */
1289
+
if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
1290
+
btmtksdio_fw_pmctrl(bdev);
1291
+
sdio_disable_func(bdev->func);
1292
1292
}
1293
1293
1294
1294
clear_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
+3
-1
drivers/bluetooth/btmtkuart.c
+3
-1
drivers/bluetooth/btmtkuart.c
···
79
79
u16 stp_dlen;
80
80
81
81
const struct btmtkuart_data *data;
82
+
struct hci_uart hu;
82
83
};
83
84
84
85
#define btmtkuart_is_standalone(bdev) \
···
369
368
sz_left -= adv;
370
369
p_left += adv;
371
370
372
-
bdev->rx_skb = h4_recv_buf(bdev->hdev, bdev->rx_skb, p_h4,
371
+
bdev->rx_skb = h4_recv_buf(&bdev->hu, bdev->rx_skb, p_h4,
373
372
sz_h4, mtk_recv_pkts,
374
373
ARRAY_SIZE(mtk_recv_pkts));
375
374
if (IS_ERR(bdev->rx_skb)) {
···
859
858
}
860
859
861
860
bdev->hdev = hdev;
861
+
bdev->hu.hdev = hdev;
862
862
863
863
hdev->bus = HCI_UART;
864
864
hci_set_drvdata(hdev, bdev);
+3
-1
drivers/bluetooth/btnxpuart.c
+3
-1
drivers/bluetooth/btnxpuart.c
···
212
212
struct ps_data psdata;
213
213
struct btnxpuart_data *nxp_data;
214
214
struct reset_control *pdn;
215
+
struct hci_uart hu;
215
216
};
216
217
217
218
#define NXP_V1_FW_REQ_PKT 0xa5
···
1757
1756
1758
1757
ps_start_timer(nxpdev);
1759
1758
1760
-
nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
1759
+
nxpdev->rx_skb = h4_recv_buf(&nxpdev->hu, nxpdev->rx_skb, data, count,
1761
1760
nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
1762
1761
if (IS_ERR(nxpdev->rx_skb)) {
1763
1762
int err = PTR_ERR(nxpdev->rx_skb);
···
1876
1875
reset_control_deassert(nxpdev->pdn);
1877
1876
1878
1877
nxpdev->hdev = hdev;
1878
+
nxpdev->hu.hdev = hdev;
1879
1879
1880
1880
hdev->bus = HCI_UART;
1881
1881
hci_set_drvdata(hdev, nxpdev);
+1
-1
drivers/bluetooth/hci_ag6xx.c
+1
-1
drivers/bluetooth/hci_ag6xx.c
···
105
105
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
106
106
return -EUNATCH;
107
107
108
-
ag6xx->rx_skb = h4_recv_buf(hu->hdev, ag6xx->rx_skb, data, count,
108
+
ag6xx->rx_skb = h4_recv_buf(hu, ag6xx->rx_skb, data, count,
109
109
ag6xx_recv_pkts,
110
110
ARRAY_SIZE(ag6xx_recv_pkts));
111
111
if (IS_ERR(ag6xx->rx_skb)) {
+1
-1
drivers/bluetooth/hci_aml.c
+1
-1
drivers/bluetooth/hci_aml.c
···
650
650
struct aml_data *aml_data = hu->priv;
651
651
int err;
652
652
653
-
aml_data->rx_skb = h4_recv_buf(hu->hdev, aml_data->rx_skb, data, count,
653
+
aml_data->rx_skb = h4_recv_buf(hu, aml_data->rx_skb, data, count,
654
654
aml_recv_pkts,
655
655
ARRAY_SIZE(aml_recv_pkts));
656
656
if (IS_ERR(aml_data->rx_skb)) {
+1
-1
drivers/bluetooth/hci_ath.c
+1
-1
drivers/bluetooth/hci_ath.c
···
191
191
{
192
192
struct ath_struct *ath = hu->priv;
193
193
194
-
ath->rx_skb = h4_recv_buf(hu->hdev, ath->rx_skb, data, count,
194
+
ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,
195
195
ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));
196
196
if (IS_ERR(ath->rx_skb)) {
197
197
int err = PTR_ERR(ath->rx_skb);
+1
-1
drivers/bluetooth/hci_bcm.c
+1
-1
drivers/bluetooth/hci_bcm.c
···
698
698
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
699
699
return -EUNATCH;
700
700
701
-
bcm->rx_skb = h4_recv_buf(hu->hdev, bcm->rx_skb, data, count,
701
+
bcm->rx_skb = h4_recv_buf(hu, bcm->rx_skb, data, count,
702
702
bcm_recv_pkts, ARRAY_SIZE(bcm_recv_pkts));
703
703
if (IS_ERR(bcm->rx_skb)) {
704
704
int err = PTR_ERR(bcm->rx_skb);
+3
-3
drivers/bluetooth/hci_h4.c
+3
-3
drivers/bluetooth/hci_h4.c
···
112
112
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
113
113
return -EUNATCH;
114
114
115
-
h4->rx_skb = h4_recv_buf(hu->hdev, h4->rx_skb, data, count,
115
+
h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count,
116
116
h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts));
117
117
if (IS_ERR(h4->rx_skb)) {
118
118
int err = PTR_ERR(h4->rx_skb);
···
151
151
return hci_uart_unregister_proto(&h4p);
152
152
}
153
153
154
-
struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
154
+
struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb,
155
155
const unsigned char *buffer, int count,
156
156
const struct h4_recv_pkt *pkts, int pkts_count)
157
157
{
158
-
struct hci_uart *hu = hci_get_drvdata(hdev);
159
158
u8 alignment = hu->alignment ? hu->alignment : 1;
159
+
struct hci_dev *hdev = hu->hdev;
160
160
161
161
/* Check for error from previous call */
162
162
if (IS_ERR(skb))
+1
-1
drivers/bluetooth/hci_intel.c
+1
-1
drivers/bluetooth/hci_intel.c
···
972
972
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
973
973
return -EUNATCH;
974
974
975
-
intel->rx_skb = h4_recv_buf(hu->hdev, intel->rx_skb, data, count,
975
+
intel->rx_skb = h4_recv_buf(hu, intel->rx_skb, data, count,
976
976
intel_recv_pkts,
977
977
ARRAY_SIZE(intel_recv_pkts));
978
978
if (IS_ERR(intel->rx_skb)) {
+1
-1
drivers/bluetooth/hci_ll.c
+1
-1
drivers/bluetooth/hci_ll.c
···
429
429
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
430
430
return -EUNATCH;
431
431
432
-
ll->rx_skb = h4_recv_buf(hu->hdev, ll->rx_skb, data, count,
432
+
ll->rx_skb = h4_recv_buf(hu, ll->rx_skb, data, count,
433
433
ll_recv_pkts, ARRAY_SIZE(ll_recv_pkts));
434
434
if (IS_ERR(ll->rx_skb)) {
435
435
int err = PTR_ERR(ll->rx_skb);
+3
-3
drivers/bluetooth/hci_mrvl.c
+3
-3
drivers/bluetooth/hci_mrvl.c
···
264
264
!test_bit(STATE_FW_LOADED, &mrvl->flags))
265
265
return count;
266
266
267
-
mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count,
268
-
mrvl_recv_pkts,
269
-
ARRAY_SIZE(mrvl_recv_pkts));
267
+
mrvl->rx_skb = h4_recv_buf(hu, mrvl->rx_skb, data, count,
268
+
mrvl_recv_pkts,
269
+
ARRAY_SIZE(mrvl_recv_pkts));
270
270
if (IS_ERR(mrvl->rx_skb)) {
271
271
int err = PTR_ERR(mrvl->rx_skb);
272
272
bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
+2
-2
drivers/bluetooth/hci_nokia.c
+2
-2
drivers/bluetooth/hci_nokia.c
···
624
624
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
625
625
return -EUNATCH;
626
626
627
-
btdev->rx_skb = h4_recv_buf(hu->hdev, btdev->rx_skb, data, count,
628
-
nokia_recv_pkts, ARRAY_SIZE(nokia_recv_pkts));
627
+
btdev->rx_skb = h4_recv_buf(hu, btdev->rx_skb, data, count,
628
+
nokia_recv_pkts, ARRAY_SIZE(nokia_recv_pkts));
629
629
if (IS_ERR(btdev->rx_skb)) {
630
630
err = PTR_ERR(btdev->rx_skb);
631
631
dev_err(dev, "Frame reassembly failed (%d)", err);
+1
-1
drivers/bluetooth/hci_qca.c
+1
-1
drivers/bluetooth/hci_qca.c
···
1277
1277
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
1278
1278
return -EUNATCH;
1279
1279
1280
-
qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
1280
+
qca->rx_skb = h4_recv_buf(hu, qca->rx_skb, data, count,
1281
1281
qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
1282
1282
if (IS_ERR(qca->rx_skb)) {
1283
1283
int err = PTR_ERR(qca->rx_skb);
+1
-1
drivers/bluetooth/hci_uart.h
+1
-1
drivers/bluetooth/hci_uart.h
···
162
162
int h4_init(void);
163
163
int h4_deinit(void);
164
164
165
-
struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
165
+
struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb,
166
166
const unsigned char *buffer, int count,
167
167
const struct h4_recv_pkt *pkts, int pkts_count);
168
168
#endif
+1
include/net/bluetooth/hci.h
+1
include/net/bluetooth/hci.h
+1
include/net/bluetooth/hci_core.h
+1
include/net/bluetooth/hci_core.h
+2
-2
include/net/bluetooth/l2cap.h
+2
-2
include/net/bluetooth/l2cap.h
···
38
38
#define L2CAP_DEFAULT_TX_WINDOW 63
39
39
#define L2CAP_DEFAULT_EXT_WINDOW 0x3FFF
40
40
#define L2CAP_DEFAULT_MAX_TX 3
41
-
#define L2CAP_DEFAULT_RETRANS_TO 2 /* seconds */
42
-
#define L2CAP_DEFAULT_MONITOR_TO 12 /* seconds */
41
+
#define L2CAP_DEFAULT_RETRANS_TO 2000 /* 2 seconds */
42
+
#define L2CAP_DEFAULT_MONITOR_TO 12000 /* 12 seconds */
43
43
#define L2CAP_DEFAULT_MAX_PDU_SIZE 1492 /* Sized for AMP packet */
44
44
#define L2CAP_DEFAULT_ACK_TO 200
45
45
#define L2CAP_DEFAULT_MAX_SDU_SIZE 0xFFFF
+1
-1
include/net/bluetooth/mgmt.h
+1
-1
include/net/bluetooth/mgmt.h
+7
net/bluetooth/hci_conn.c
+7
net/bluetooth/hci_conn.c
···
843
843
if (bis)
844
844
return;
845
845
846
+
bis = hci_conn_hash_lookup_big_state(hdev,
847
+
conn->iso_qos.bcast.big,
848
+
BT_OPEN,
849
+
HCI_ROLE_MASTER);
850
+
if (bis)
851
+
return;
852
+
846
853
hci_le_terminate_big(hdev, conn);
847
854
} else {
848
855
hci_le_big_terminate(hdev, conn->iso_qos.bcast.big,
+9
-2
net/bluetooth/hci_event.c
+9
-2
net/bluetooth/hci_event.c
···
1607
1607
1608
1608
hci_dev_set_flag(hdev, HCI_LE_ADV);
1609
1609
1610
-
if (adv && !adv->periodic)
1610
+
if (adv)
1611
1611
adv->enabled = true;
1612
+
else if (!set->handle)
1613
+
hci_dev_set_flag(hdev, HCI_LE_ADV_0);
1612
1614
1613
1615
conn = hci_lookup_le_connect(hdev);
1614
1616
if (conn)
···
1621
1619
if (cp->num_of_sets) {
1622
1620
if (adv)
1623
1621
adv->enabled = false;
1622
+
else if (!set->handle)
1623
+
hci_dev_clear_flag(hdev, HCI_LE_ADV_0);
1624
1624
1625
1625
/* If just one instance was disabled check if there are
1626
1626
* any other instance enabled before clearing HCI_LE_ADV
···
3963
3959
hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
3964
3960
3965
3961
if (adv)
3966
-
adv->enabled = true;
3962
+
adv->periodic_enabled = true;
3967
3963
} else {
3964
+
if (adv)
3965
+
adv->periodic_enabled = false;
3966
+
3968
3967
/* If just one instance was disabled check if there are
3969
3968
* any other instance enabled before clearing HCI_LE_PER_ADV.
3970
3969
* The current periodic adv instance will be marked as
+14
-9
net/bluetooth/hci_sync.c
+14
-9
net/bluetooth/hci_sync.c
···
863
863
{
864
864
struct hci_cmd_sync_work_entry *entry;
865
865
866
-
entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
867
-
if (!entry)
868
-
return false;
866
+
mutex_lock(&hdev->cmd_sync_work_lock);
869
867
870
-
hci_cmd_sync_cancel_entry(hdev, entry);
868
+
entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
869
+
if (!entry) {
870
+
mutex_unlock(&hdev->cmd_sync_work_lock);
871
+
return false;
872
+
}
873
+
874
+
_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
875
+
876
+
mutex_unlock(&hdev->cmd_sync_work_lock);
871
877
872
878
return true;
873
879
}
···
1607
1601
1608
1602
/* If periodic advertising already disabled there is nothing to do. */
1609
1603
adv = hci_find_adv_instance(hdev, instance);
1610
-
if (!adv || !adv->periodic || !adv->enabled)
1604
+
if (!adv || !adv->periodic_enabled)
1611
1605
return 0;
1612
1606
1613
1607
memset(&cp, 0, sizeof(cp));
···
1672
1666
1673
1667
/* If periodic advertising already enabled there is nothing to do. */
1674
1668
adv = hci_find_adv_instance(hdev, instance);
1675
-
if (adv && adv->periodic && adv->enabled)
1669
+
if (adv && adv->periodic_enabled)
1676
1670
return 0;
1677
1671
1678
1672
memset(&cp, 0, sizeof(cp));
···
2606
2600
/* If current advertising instance is set to instance 0x00
2607
2601
* then we need to re-enable it.
2608
2602
*/
2609
-
if (!hdev->cur_adv_instance)
2610
-
err = hci_enable_ext_advertising_sync(hdev,
2611
-
hdev->cur_adv_instance);
2603
+
if (hci_dev_test_and_clear_flag(hdev, HCI_LE_ADV_0))
2604
+
err = hci_enable_ext_advertising_sync(hdev, 0x00);
2612
2605
} else {
2613
2606
/* Schedule for most recent instance to be restarted and begin
2614
2607
* the software rotation loop
+8
-2
net/bluetooth/iso.c
+8
-2
net/bluetooth/iso.c
···
2032
2032
*/
2033
2033
if (!bacmp(&hcon->dst, BDADDR_ANY)) {
2034
2034
bacpy(&hcon->dst, &iso_pi(parent)->dst);
2035
-
hcon->dst_type = iso_pi(parent)->dst_type;
2035
+
hcon->dst_type = le_addr_type(iso_pi(parent)->dst_type);
2036
2036
}
2037
2037
2038
2038
if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) {
···
2046
2046
}
2047
2047
2048
2048
bacpy(&iso_pi(sk)->dst, &hcon->dst);
2049
-
iso_pi(sk)->dst_type = hcon->dst_type;
2049
+
2050
+
/* Convert from HCI to three-value type */
2051
+
if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
2052
+
iso_pi(sk)->dst_type = BDADDR_LE_PUBLIC;
2053
+
else
2054
+
iso_pi(sk)->dst_type = BDADDR_LE_RANDOM;
2055
+
2050
2056
iso_pi(sk)->sync_handle = iso_pi(parent)->sync_handle;
2051
2057
memcpy(iso_pi(sk)->base, iso_pi(parent)->base, iso_pi(parent)->base_len);
2052
2058
iso_pi(sk)->base_len = iso_pi(parent)->base_len;
+2
-2
net/bluetooth/l2cap_core.c
+2
-2
net/bluetooth/l2cap_core.c
···
282
282
if (!delayed_work_pending(&chan->monitor_timer) &&
283
283
chan->retrans_timeout) {
284
284
l2cap_set_timer(chan, &chan->retrans_timer,
285
-
secs_to_jiffies(chan->retrans_timeout));
285
+
msecs_to_jiffies(chan->retrans_timeout));
286
286
}
287
287
}
288
288
···
291
291
__clear_retrans_timer(chan);
292
292
if (chan->monitor_timeout) {
293
293
l2cap_set_timer(chan, &chan->monitor_timer,
294
-
secs_to_jiffies(chan->monitor_timeout));
294
+
msecs_to_jiffies(chan->monitor_timeout));
295
295
}
296
296
}
297
297
+15
-11
net/bluetooth/mgmt.c
+15
-11
net/bluetooth/mgmt.c
···
2175
2175
sk = cmd->sk;
2176
2176
2177
2177
if (status) {
2178
+
mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2179
+
status);
2178
2180
mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,
2179
2181
cmd_status_rsp, &status);
2180
-
return;
2182
+
goto done;
2181
2183
}
2182
2184
2183
-
mgmt_pending_remove(cmd);
2184
2185
mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2186
+
2187
+
done:
2188
+
mgmt_pending_free(cmd);
2185
2189
}
2186
2190
2187
2191
static int set_mesh_sync(struct hci_dev *hdev, void *data)
2188
2192
{
2189
2193
struct mgmt_pending_cmd *cmd = data;
2190
-
struct mgmt_cp_set_mesh cp;
2194
+
DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types,
2195
+
sizeof(hdev->mesh_ad_types));
2191
2196
size_t len;
2192
2197
2193
2198
mutex_lock(&hdev->mgmt_pending_lock);
···
2202
2197
return -ECANCELED;
2203
2198
}
2204
2199
2205
-
memcpy(&cp, cmd->param, sizeof(cp));
2200
+
len = cmd->param_len;
2201
+
memcpy(cp, cmd->param, min(__struct_size(cp), len));
2206
2202
2207
2203
mutex_unlock(&hdev->mgmt_pending_lock);
2208
2204
2209
-
len = cmd->param_len;
2210
-
2211
2205
memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2212
2206
2213
-
if (cp.enable)
2207
+
if (cp->enable)
2214
2208
hci_dev_set_flag(hdev, HCI_MESH);
2215
2209
else
2216
2210
hci_dev_clear_flag(hdev, HCI_MESH);
2217
2211
2218
-
hdev->le_scan_interval = __le16_to_cpu(cp.period);
2219
-
hdev->le_scan_window = __le16_to_cpu(cp.window);
2212
+
hdev->le_scan_interval = __le16_to_cpu(cp->period);
2213
+
hdev->le_scan_window = __le16_to_cpu(cp->window);
2220
2214
2221
-
len -= sizeof(cp);
2215
+
len -= sizeof(struct mgmt_cp_set_mesh);
2222
2216
2223
2217
/* If filters don't fit, forward all adv pkts */
2224
2218
if (len <= sizeof(hdev->mesh_ad_types))
2225
-
memcpy(hdev->mesh_ad_types, cp.ad_types, len);
2219
+
memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2226
2220
2227
2221
hci_update_passive_scan_sync(hdev);
2228
2222
return 0;
+11
-15
net/bluetooth/rfcomm/tty.c
+11
-15
net/bluetooth/rfcomm/tty.c
···
643
643
tty_port_tty_hangup(&dev->port, true);
644
644
645
645
dev->modem_status =
646
-
((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
647
-
((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
646
+
((v24_sig & RFCOMM_V24_RTC) ? TIOCM_DSR : 0) |
647
+
((v24_sig & RFCOMM_V24_RTR) ? TIOCM_CTS : 0) |
648
648
((v24_sig & RFCOMM_V24_IC) ? TIOCM_RI : 0) |
649
649
((v24_sig & RFCOMM_V24_DV) ? TIOCM_CD : 0);
650
650
}
···
1055
1055
static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1056
1056
{
1057
1057
struct rfcomm_dev *dev = tty->driver_data;
1058
+
struct rfcomm_dlc *dlc = dev->dlc;
1059
+
u8 v24_sig;
1058
1060
1059
1061
BT_DBG("tty %p dev %p", tty, dev);
1060
1062
1061
-
return dev->modem_status;
1063
+
rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1064
+
1065
+
return (v24_sig & (TIOCM_DTR | TIOCM_RTS)) | dev->modem_status;
1062
1066
}
1063
1067
1064
1068
static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
···
1075
1071
1076
1072
rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1077
1073
1078
-
if (set & TIOCM_DSR || set & TIOCM_DTR)
1074
+
if (set & TIOCM_DTR)
1079
1075
v24_sig |= RFCOMM_V24_RTC;
1080
-
if (set & TIOCM_RTS || set & TIOCM_CTS)
1076
+
if (set & TIOCM_RTS)
1081
1077
v24_sig |= RFCOMM_V24_RTR;
1082
-
if (set & TIOCM_RI)
1083
-
v24_sig |= RFCOMM_V24_IC;
1084
-
if (set & TIOCM_CD)
1085
-
v24_sig |= RFCOMM_V24_DV;
1086
1078
1087
-
if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1079
+
if (clear & TIOCM_DTR)
1088
1080
v24_sig &= ~RFCOMM_V24_RTC;
1089
-
if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1081
+
if (clear & TIOCM_RTS)
1090
1082
v24_sig &= ~RFCOMM_V24_RTR;
1091
-
if (clear & TIOCM_RI)
1092
-
v24_sig &= ~RFCOMM_V24_IC;
1093
-
if (clear & TIOCM_CD)
1094
-
v24_sig &= ~RFCOMM_V24_DV;
1095
1083
1096
1084
rfcomm_dlc_set_modem_status(dlc, v24_sig);
1097
1085