From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 15:03:13 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=018c0c4fed865b26be56abf540a2d6bb7579ccf6;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: alsa-seq-avoid-confusion-of-aligned-read-size.patch bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch --- diff --git a/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch new file mode 100644 index 0000000000..2c4fd42258 --- /dev/null +++ b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch @@ -0,0 +1,44 @@ +From 8c15a18331191b67bdce54d21af068baec044baf Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 Jun 2023 16:47:58 +0200 +Subject: ALSA: seq: Avoid confusion of aligned read size + +From: Takashi Iwai + +commit 8c15a18331191b67bdce54d21af068baec044baf upstream. + +Currently the read event packet size in snd_seq_read() is defined by +client->midi_version value that is guaranteed to be zero if UMP isn't +enabled. But the static analyzer doesn't know of the fact, and it +still suspects as if it were leading to a potential overflow. + +Add the more explicit check of CONFIG_SND_SEQ_UMP to determine the +aligned_size value for avoiding the confusion. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202305261415.NY0vapZK-lkp@intel.com/ +Link: https://lore.kernel.org/r/20230605144758.6677-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 948ae45e0cc3..e3f9ea67d019 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -451,7 +451,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count, + err = 0; + snd_seq_fifo_lock(fifo); + +- if (client->midi_version > 0) ++ if (IS_ENABLED(CONFIG_SND_SEQ_UMP) && client->midi_version > 0) + aligned_size = sizeof(struct snd_seq_ump_event); + else + aligned_size = sizeof(struct snd_seq_event); +-- +2.55.0 + diff --git a/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch b/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch new file mode 100644 index 0000000000..7582bfc729 --- /dev/null +++ b/queue-5.15/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch @@ -0,0 +1,81 @@ +From 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 17 Mar 2026 11:54:01 -0400 +Subject: Bluetooth: L2CAP: Fix regressions caused by reusing ident + +From: Luiz Augusto von Dentz + +commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream. + +This attempt to fix regressions caused by reusing ident which apparently +is not handled well on certain stacks causing the stack to not respond to +requests, so instead of simple returning the first unallocated id this +stores the last used tx_ident and then attempt to use the next until all +available ids are exausted and then cycle starting over to 1. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177 +Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") +Signed-off-by: Luiz Augusto von Dentz +Tested-by: Christian Eggers +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/l2cap.h | 1 + + net/bluetooth/l2cap_core.c | 29 ++++++++++++++++++++++++++--- + 2 files changed, 27 insertions(+), 3 deletions(-) + +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -692,6 +692,7 @@ struct l2cap_conn { + struct sk_buff *rx_skb; + __u32 rx_len; + struct ida tx_ida; ++ __u8 tx_ident; + + struct sk_buff_head pending_rx; + struct work_struct pending_rx_work; +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -939,16 +939,39 @@ int l2cap_chan_check_security(struct l2c + + static int l2cap_get_ident(struct l2cap_conn *conn) + { ++ u8 max; ++ int ident; ++ + /* LE link does not support tools like l2ping so use the full range */ + if (conn->hcon->type == LE_LINK) +- return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC); +- ++ max = 255; + /* Get next available identificator. + * 1 - 128 are used by kernel. + * 129 - 199 are reserved. + * 200 - 254 are used by utilities like l2ping, etc. + */ +- return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC); ++ else ++ max = 128; ++ ++ /* Allocate ident using min as last used + 1 (cyclic) */ ++ ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1, ++ max, GFP_ATOMIC); ++ /* Force min 1 to start over */ ++ if (ident <= 0) { ++ ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC); ++ if (ident <= 0) { ++ /* If all idents are in use, log an error, this is ++ * extremely unlikely to happen and would indicate a bug ++ * in the code that idents are not being freed properly. ++ */ ++ BT_ERR("Unable to allocate ident: %d", ident); ++ return 0; ++ } ++ } ++ ++ WRITE_ONCE(conn->tx_ident, ident); ++ ++ return ident; + } + + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, diff --git a/queue-5.15/series b/queue-5.15/series index b7fae05e60..561199d594 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -833,3 +833,5 @@ audit-fix-potential-integer-overflow-in-audit_log_n_hex.patch regulator-scmi-fix-of_node-refcount-leak-in-scmi_regulator_probe.patch posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch +bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch +alsa-seq-avoid-confusion-of-aligned-read-size.patch