From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 30 Mar 2024 16:25:31 +0000 (+0100)
Subject: 6.1-stable patches
X-Git-Tag: v6.7.12~102
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f13b539037a418edcc3c3ae2c4535bb2d49edce3;p=thirdparty%2Fkernel%2Fstable-queue.git

6.1-stable patches

added patches:
	bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
---

diff --git a/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch b/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
new file mode 100644
index 00000000000..9ff7247c383
--- /dev/null
+++ b/queue-6.1/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
@@ -0,0 +1,68 @@
+From 1c3366abdbe884be62e5a7502b4db758aa3974c6 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 26 Mar 2024 12:43:17 -0400
+Subject: Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 1c3366abdbe884be62e5a7502b4db758aa3974c6 upstream.
+
+hci_cmd_sync_cancel_sync shall check the error passed to it since it
+will be propagated using req_result which is __u32 it needs to be
+properly set to a positive value if it was passed as negative othertise
+IS_ERR will not trigger as -(errno) would be converted to a positive
+value.
+
+Fixes: 63298d6e752f ("Bluetooth: hci_core: Cancel request on command timeout")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reported-and-tested-by: Thorsten Leemhuis <linux@leemhuis.info>
+Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_core.c |    6 +++---
+ net/bluetooth/hci_sync.c |    5 ++++-
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -2838,7 +2838,7 @@ static void hci_cancel_cmd_sync(struct h
+ 	cancel_delayed_work_sync(&hdev->ncmd_timer);
+ 	atomic_set(&hdev->cmd_cnt, 1);
+ 
+-	hci_cmd_sync_cancel_sync(hdev, -err);
++	hci_cmd_sync_cancel_sync(hdev, err);
+ }
+ 
+ /* Suspend HCI device */
+@@ -2858,7 +2858,7 @@ int hci_suspend_dev(struct hci_dev *hdev
+ 		return 0;
+ 
+ 	/* Cancel potentially blocking sync operation before suspend */
+-	hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
++	hci_cancel_cmd_sync(hdev, EHOSTDOWN);
+ 
+ 	hci_req_sync_lock(hdev);
+ 	ret = hci_suspend_sync(hdev);
+@@ -4169,7 +4169,7 @@ static void hci_send_cmd_sync(struct hci
+ 
+ 	err = hci_send_frame(hdev, skb);
+ 	if (err < 0) {
+-		hci_cmd_sync_cancel_sync(hdev, err);
++		hci_cmd_sync_cancel_sync(hdev, -err);
+ 		return;
+ 	}
+ 
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -678,7 +678,10 @@ void hci_cmd_sync_cancel_sync(struct hci
+ 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
+ 
+ 	if (hdev->req_status == HCI_REQ_PEND) {
+-		hdev->req_result = err;
++		/* req_result is __u32 so error must be positive to be properly
++		 * propagated.
++		 */
++		hdev->req_result = err < 0 ? -err : err;
+ 		hdev->req_status = HCI_REQ_CANCELED;
+ 
+ 		wake_up_interruptible(&hdev->req_wait_q);
diff --git a/queue-6.1/series b/queue-6.1/series
index a3f778d2ab5..07eef3a289b 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -227,3 +227,4 @@ drm-vmwgfx-create-debugfs-ttm_resource_manager-entry-only-if-needed.patch
 drm-amdkfd-fix-tlb-flush-after-unmap-for-gfx9.4.2.patch
 drm-i915-bios-tolerate-devdata-null-in-intel_bios_encoder_supports_dp_dual_mode.patch
 drm-i915-gt-reset-queue_priority_hint-on-parking.patch
+bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch