5.15-stable patches

added patches:
	alsa-seq-avoid-confusion-of-aligned-read-size.patch
	bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch

diff --git a/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch
new file mode 100644 (file)
index 0000000..2c4fd42
--- /dev/null
+++ b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch
@@ -0,0 +1,44 @@
+From 8c15a18331191b67bdce54d21af068baec044baf Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 Jun 2023 16:47:58 +0200
+Subject: ALSA: seq: Avoid confusion of aligned read size
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8c15a18331191b67bdce54d21af068baec044baf upstream.
+
+Currently the read event packet size in snd_seq_read() is defined by
+client->midi_version value that is guaranteed to be zero if UMP isn't
+enabled.  But the static analyzer doesn't know of the fact, and it
+still suspects as if it were leading to a potential overflow.
+
+Add the more explicit check of CONFIG_SND_SEQ_UMP to determine the
+aligned_size value for avoiding the confusion.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202305261415.NY0vapZK-lkp@intel.com/
+Link: https://lore.kernel.org/r/20230605144758.6677-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 948ae45e0cc3..e3f9ea67d019 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -451,7 +451,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
+       err = 0;
+       snd_seq_fifo_lock(fifo);
+ 
+-      if (client->midi_version > 0)
++      if (IS_ENABLED(CONFIG_SND_SEQ_UMP) && client->midi_version > 0)
+               aligned_size = sizeof(struct snd_seq_ump_event);
+       else
+               aligned_size = sizeof(struct snd_seq_event);
+-- 
+2.55.0
+

diff --git a/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch b/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
new file mode 100644 (file)
index 0000000..7582bfc
--- /dev/null
+++ b/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
@@ -0,0 +1,81 @@
+From 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 17 Mar 2026 11:54:01 -0400
+Subject: Bluetooth: L2CAP: Fix regressions caused by reusing ident
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream.
+
+This attempt to fix regressions caused by reusing ident which apparently
+is not handled well on certain stacks causing the stack to not respond to
+requests, so instead of simple returning the first unallocated id this
+stores the last used tx_ident and then attempt to use the next until all
+available ids are exausted and then cycle starting over to 1.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177
+Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Tested-by: Christian Eggers <ceggers@arri.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/bluetooth/l2cap.h |    1 +
+ net/bluetooth/l2cap_core.c    |   29 ++++++++++++++++++++++++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+--- a/include/net/bluetooth/l2cap.h
++++ b/include/net/bluetooth/l2cap.h
+@@ -692,6 +692,7 @@ struct l2cap_conn {
+       struct sk_buff          *rx_skb;
+       __u32                   rx_len;
+       struct ida              tx_ida;
++      __u8                    tx_ident;
+ 
+       struct sk_buff_head     pending_rx;
+       struct work_struct      pending_rx_work;
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -939,16 +939,39 @@ int l2cap_chan_check_security(struct l2c
+ 
+ static int l2cap_get_ident(struct l2cap_conn *conn)
+ {
++      u8 max;
++      int ident;
++
+       /* LE link does not support tools like l2ping so use the full range */
+       if (conn->hcon->type == LE_LINK)
+-              return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
+-
++              max = 255;
+       /* Get next available identificator.
+        *    1 - 128 are used by kernel.
+        *  129 - 199 are reserved.
+        *  200 - 254 are used by utilities like l2ping, etc.
+        */
+-      return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
++      else
++              max = 128;
++
++      /* Allocate ident using min as last used + 1 (cyclic) */
++      ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
++                              max, GFP_ATOMIC);
++      /* Force min 1 to start over */
++      if (ident <= 0) {
++              ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
++              if (ident <= 0) {
++                      /* If all idents are in use, log an error, this is
++                       * extremely unlikely to happen and would indicate a bug
++                       * in the code that idents are not being freed properly.
++                       */
++                      BT_ERR("Unable to allocate ident: %d", ident);
++                      return 0;
++              }
++      }
++
++      WRITE_ONCE(conn->tx_ident, ident);
++
++      return ident;
+ }
+ 
+ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,

diff --git a/queue-5.15/series b/queue-5.15/series
index b7fae05e602d2d87811e54bf53b9500a48d797b3..561199d5941d1e686e0f38172ed7bf3ed16994bd 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -833,3 +833,5 @@ audit-fix-potential-integer-overflow-in-audit_log_n_hex.patch
 regulator-scmi-fix-of_node-refcount-leak-in-scmi_regulator_probe.patch
 posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch
 kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch
+bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
+alsa-seq-avoid-confusion-of-aligned-read-size.patch