Skip to content

Commit 1fd2672

Browse files
author
Paolo Abeni
committed
Merge tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - L2CAP: Fix L2CAP MTU negotiation - hci_core: Fix use-after-free in vhci_flush() - btintel_pcie: Fix potential race condition in firmware download - hci_qca: fix unable to load the BT driver * tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_core: Fix use-after-free in vhci_flush() driver: bluetooth: hci_qca:fix unable to load the BT driver Bluetooth: L2CAP: Fix L2CAP MTU negotiation Bluetooth: btintel_pcie: Fix potential race condition in firmware download ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents c3f4293 + 1d61231 commit 1fd2672

File tree

5 files changed

+81
-10
lines changed

5 files changed

+81
-10
lines changed

‎drivers/bluetooth/btintel_pcie.c‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2033,6 +2033,28 @@ static void btintel_pcie_release_hdev(struct btintel_pcie_data *data)
20332033
data->hdev = NULL;
20342034
}
20352035

2036+
static void btintel_pcie_disable_interrupts(struct btintel_pcie_data *data)
2037+
{
2038+
spin_lock(&data->irq_lock);
2039+
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, data->fh_init_mask);
2040+
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, data->hw_init_mask);
2041+
spin_unlock(&data->irq_lock);
2042+
}
2043+
2044+
static void btintel_pcie_enable_interrupts(struct btintel_pcie_data *data)
2045+
{
2046+
spin_lock(&data->irq_lock);
2047+
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, ~data->fh_init_mask);
2048+
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, ~data->hw_init_mask);
2049+
spin_unlock(&data->irq_lock);
2050+
}
2051+
2052+
static void btintel_pcie_synchronize_irqs(struct btintel_pcie_data *data)
2053+
{
2054+
for (int i = 0; i < data->alloc_vecs; i++)
2055+
synchronize_irq(data->msix_entries[i].vector);
2056+
}
2057+
20362058
static int btintel_pcie_setup_internal(struct hci_dev *hdev)
20372059
{
20382060
struct btintel_pcie_data *data = hci_get_drvdata(hdev);
@@ -2152,13 +2174,16 @@ static int btintel_pcie_setup(struct hci_dev *hdev)
21522174
bt_dev_err(hdev, "Firmware download retry count: %d",
21532175
fw_dl_retry);
21542176
btintel_pcie_dump_debug_registers(hdev);
2177+
btintel_pcie_disable_interrupts(data);
2178+
btintel_pcie_synchronize_irqs(data);
21552179
err = btintel_pcie_reset_bt(data);
21562180
if (err) {
21572181
bt_dev_err(hdev, "Failed to do shr reset: %d", err);
21582182
break;
21592183
}
21602184
usleep_range(10000, 12000);
21612185
btintel_pcie_reset_ia(data);
2186+
btintel_pcie_enable_interrupts(data);
21622187
btintel_pcie_config_msix(data);
21632188
err = btintel_pcie_enable_bt(data);
21642189
if (err) {
@@ -2291,6 +2316,12 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
22912316

22922317
data = pci_get_drvdata(pdev);
22932318

2319+
btintel_pcie_disable_interrupts(data);
2320+
2321+
btintel_pcie_synchronize_irqs(data);
2322+
2323+
flush_work(&data->rx_work);
2324+
22942325
btintel_pcie_reset_bt(data);
22952326
for (int i = 0; i < data->alloc_vecs; i++) {
22962327
struct msix_entry *msix_entry;
@@ -2303,8 +2334,6 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
23032334

23042335
btintel_pcie_release_hdev(data);
23052336

2306-
flush_work(&data->rx_work);
2307-
23082337
destroy_workqueue(data->workqueue);
23092338

23102339
btintel_pcie_free(data);

‎drivers/bluetooth/hci_qca.c‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2392,10 +2392,17 @@ static int qca_serdev_probe(struct serdev_device *serdev)
23922392
*/
23932393
qcadev->bt_power->pwrseq = devm_pwrseq_get(&serdev->dev,
23942394
"bluetooth");
2395-
if (IS_ERR(qcadev->bt_power->pwrseq))
2396-
return PTR_ERR(qcadev->bt_power->pwrseq);
23972395

2398-
break;
2396+
/*
2397+
* Some modules have BT_EN enabled via a hardware pull-up,
2398+
* meaning it is not defined in the DTS and is not controlled
2399+
* through the power sequence. In such cases, fall through
2400+
* to follow the legacy flow.
2401+
*/
2402+
if (IS_ERR(qcadev->bt_power->pwrseq))
2403+
qcadev->bt_power->pwrseq = NULL;
2404+
else
2405+
break;
23992406
}
24002407
fallthrough;
24012408
case QCA_WCN3950:

‎include/net/bluetooth/hci_core.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#include <linux/idr.h>
3030
#include <linux/leds.h>
3131
#include <linux/rculist.h>
32+
#include <linux/srcu.h>
3233

3334
#include <net/bluetooth/hci.h>
3435
#include <net/bluetooth/hci_drv.h>
@@ -347,6 +348,7 @@ struct adv_monitor {
347348

348349
struct hci_dev {
349350
struct list_head list;
351+
struct srcu_struct srcu;
350352
struct mutex lock;
351353

352354
struct ida unset_handle_ida;

‎net/bluetooth/hci_core.c‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ static DEFINE_IDA(hci_index_ida);
6464

6565
/* Get HCI device by index.
6666
* Device is held on return. */
67-
struct hci_dev *hci_dev_get(int index)
67+
static struct hci_dev *__hci_dev_get(int index, int *srcu_index)
6868
{
6969
struct hci_dev *hdev = NULL, *d;
7070

@@ -77,13 +77,31 @@ struct hci_dev *hci_dev_get(int index)
7777
list_for_each_entry(d, &hci_dev_list, list) {
7878
if (d->id == index) {
7979
hdev = hci_dev_hold(d);
80+
if (srcu_index)
81+
*srcu_index = srcu_read_lock(&d->srcu);
8082
break;
8183
}
8284
}
8385
read_unlock(&hci_dev_list_lock);
8486
return hdev;
8587
}
8688

89+
struct hci_dev *hci_dev_get(int index)
90+
{
91+
return __hci_dev_get(index, NULL);
92+
}
93+
94+
static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index)
95+
{
96+
return __hci_dev_get(index, srcu_index);
97+
}
98+
99+
static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index)
100+
{
101+
srcu_read_unlock(&hdev->srcu, srcu_index);
102+
hci_dev_put(hdev);
103+
}
104+
87105
/* ---- Inquiry support ---- */
88106

89107
bool hci_discovery_active(struct hci_dev *hdev)
@@ -568,9 +586,9 @@ static int hci_dev_do_reset(struct hci_dev *hdev)
568586
int hci_dev_reset(__u16 dev)
569587
{
570588
struct hci_dev *hdev;
571-
int err;
589+
int err, srcu_index;
572590

573-
hdev = hci_dev_get(dev);
591+
hdev = hci_dev_get_srcu(dev, &srcu_index);
574592
if (!hdev)
575593
return -ENODEV;
576594

@@ -592,7 +610,7 @@ int hci_dev_reset(__u16 dev)
592610
err = hci_dev_do_reset(hdev);
593611

594612
done:
595-
hci_dev_put(hdev);
613+
hci_dev_put_srcu(hdev, srcu_index);
596614
return err;
597615
}
598616

@@ -2433,6 +2451,11 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
24332451
if (!hdev)
24342452
return NULL;
24352453

2454+
if (init_srcu_struct(&hdev->srcu)) {
2455+
kfree(hdev);
2456+
return NULL;
2457+
}
2458+
24362459
hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
24372460
hdev->esco_type = (ESCO_HV1);
24382461
hdev->link_mode = (HCI_LM_ACCEPT);
@@ -2678,6 +2701,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
26782701
list_del(&hdev->list);
26792702
write_unlock(&hci_dev_list_lock);
26802703

2704+
synchronize_srcu(&hdev->srcu);
2705+
cleanup_srcu_struct(&hdev->srcu);
2706+
26812707
disable_work_sync(&hdev->rx_work);
26822708
disable_work_sync(&hdev->cmd_work);
26832709
disable_work_sync(&hdev->tx_work);

‎net/bluetooth/l2cap_core.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3415,7 +3415,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
34153415
struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
34163416
struct l2cap_conf_efs efs;
34173417
u8 remote_efs = 0;
3418-
u16 mtu = L2CAP_DEFAULT_MTU;
3418+
u16 mtu = 0;
34193419
u16 result = L2CAP_CONF_SUCCESS;
34203420
u16 size;
34213421

@@ -3520,6 +3520,13 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
35203520
/* Configure output options and let the other side know
35213521
* which ones we don't like. */
35223522

3523+
/* If MTU is not provided in configure request, use the most recently
3524+
* explicitly or implicitly accepted value for the other direction,
3525+
* or the default value.
3526+
*/
3527+
if (mtu == 0)
3528+
mtu = chan->imtu ? chan->imtu : L2CAP_DEFAULT_MTU;
3529+
35233530
if (mtu < L2CAP_DEFAULT_MIN_MTU)
35243531
result = L2CAP_CONF_UNACCEPT;
35253532
else {

0 commit comments

Comments
 (0)