6.1-stable patches

added patches:
	bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch

diff --git a/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch b/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
new file mode 100644 (file)
index 0000000..9ff7247
--- /dev/null
+++ b/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
@@ -0,0 +1,68 @@
+From 1c3366abdbe884be62e5a7502b4db758aa3974c6 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 26 Mar 2024 12:43:17 -0400
+Subject: Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 1c3366abdbe884be62e5a7502b4db758aa3974c6 upstream.
+
+hci_cmd_sync_cancel_sync shall check the error passed to it since it
+will be propagated using req_result which is __u32 it needs to be
+properly set to a positive value if it was passed as negative othertise
+IS_ERR will not trigger as -(errno) would be converted to a positive
+value.
+
+Fixes: 63298d6e752f ("Bluetooth: hci_core: Cancel request on command timeout")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reported-and-tested-by: Thorsten Leemhuis <linux@leemhuis.info>
+Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_core.c |    6 +++---
+ net/bluetooth/hci_sync.c |    5 ++++-
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -2838,7 +2838,7 @@ static void hci_cancel_cmd_sync(struct h
+       cancel_delayed_work_sync(&hdev->ncmd_timer);
+       atomic_set(&hdev->cmd_cnt, 1);
+ 
+-      hci_cmd_sync_cancel_sync(hdev, -err);
++      hci_cmd_sync_cancel_sync(hdev, err);
+ }
+ 
+ /* Suspend HCI device */
+@@ -2858,7 +2858,7 @@ int hci_suspend_dev(struct hci_dev *hdev
+               return 0;
+ 
+       /* Cancel potentially blocking sync operation before suspend */
+-      hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
++      hci_cancel_cmd_sync(hdev, EHOSTDOWN);
+ 
+       hci_req_sync_lock(hdev);
+       ret = hci_suspend_sync(hdev);
+@@ -4169,7 +4169,7 @@ static void hci_send_cmd_sync(struct hci
+ 
+       err = hci_send_frame(hdev, skb);
+       if (err < 0) {
+-              hci_cmd_sync_cancel_sync(hdev, err);
++              hci_cmd_sync_cancel_sync(hdev, -err);
+               return;
+       }
+ 
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -678,7 +678,10 @@ void hci_cmd_sync_cancel_sync(struct hci
+       bt_dev_dbg(hdev, "err 0x%2.2x", err);
+ 
+       if (hdev->req_status == HCI_REQ_PEND) {
+-              hdev->req_result = err;
++              /* req_result is __u32 so error must be positive to be properly
++               * propagated.
++               */
++              hdev->req_result = err < 0 ? -err : err;
+               hdev->req_status = HCI_REQ_CANCELED;
+ 
+               wake_up_interruptible(&hdev->req_wait_q);

diff --git a/queue-6.1/series b/queue-6.1/series
index a3f778d2ab5ab7fa22f1b71f9ee3dafd8f3fb458..07eef3a289b76214572e7ce38c77138edf8d3e4d 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -227,3 +227,4 @@ drm-vmwgfx-create-debugfs-ttm_resource_manager-entry-only-if-needed.patch
 drm-amdkfd-fix-tlb-flush-after-unmap-for-gfx9.4.2.patch
 drm-i915-bios-tolerate-devdata-null-in-intel_bios_encoder_supports_dp_dual_mode.patch
 drm-i915-gt-reset-queue_priority_hint-on-parking.patch
+bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch