--- /dev/null
+From 19eef1d98eeda3745df35839190b7d4a4adea656 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Sat, 29 Nov 2025 00:40:11 +0000
+Subject: afs: Fix uninit var in afs_alloc_anon_key()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 19eef1d98eeda3745df35839190b7d4a4adea656 upstream.
+
+Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it
+to cell->anonymous_key. Without this change, the error check may return a
+false failure with a bad error number.
+
+Most of the time this is unlikely to happen because the first encounter
+with afs_alloc_anon_key() will usually be from (auto)mount, for which all
+subsequent operations must wait - apart from other (auto)mounts. Once the
+call->anonymous_key is allocated, all further calls to afs_request_key()
+will skip the call to afs_alloc_anon_key() for that cell.
+
+Fixes: d27c71257825 ("afs: Fix delayed allocation of a cell's anonymous key")
+Reported-by: Paulo Alcantra <pc@manguebit.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Paulo Alcantara <pc@manguebit.org>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/security.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/afs/security.c
++++ b/fs/afs/security.c
+@@ -26,7 +26,8 @@ static int afs_alloc_anon_key(struct afs
+ struct key *key;
+
+ mutex_lock(&afs_key_lock);
+- if (!cell->anonymous_key) {
++ key = cell->anonymous_key;
++ if (!key) {
+ key = rxrpc_get_null_key(cell->key_desc);
+ if (!IS_ERR(key))
+ cell->anonymous_key = key;
--- /dev/null
+From bfa9d28960ed677d556bdf097073bc3129686229 Mon Sep 17 00:00:00 2001
+From: Pavitra Jha <jhapavitra98@gmail.com>
+Date: Thu, 21 May 2026 04:04:14 -0400
+Subject: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
+
+From: Pavitra Jha <jhapavitra98@gmail.com>
+
+commit bfa9d28960ed677d556bdf097073bc3129686229 upstream.
+
+hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but
+returns 0 without freeing it when neither pa_sync_term nor big_sync_term
+flags are set after evaluating the PA and BIG sync connection state.
+
+This early-return path was introduced when hci_le_big_terminate() was
+refactored to take struct hci_conn instead of raw u8 parameters, adding
+PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue
+failure does not cover this path.
+
+Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_conn.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -804,8 +804,10 @@ static int hci_le_big_terminate(struct h
+ d->big_sync_term = true;
+ }
+
+- if (!d->pa_sync_term && !d->big_sync_term)
++ if (!d->pa_sync_term && !d->big_sync_term) {
++ kfree(d);
+ return 0;
++ }
+
+ ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
+ terminate_big_destroy);
--- /dev/null
+From 3ba486c5f3ce2c22ffd29c0103404cdbe21912b3 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 29 Jul 2025 12:11:09 -0400
+Subject: Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 3ba486c5f3ce2c22ffd29c0103404cdbe21912b3 upstream.
+
+This fixes Broadcaster/Broadcast Source not sending HCI_OP_LE_TERM_BIG
+because HCI_CONN_PER_ADV where not being set.
+
+Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_conn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2277,7 +2277,7 @@ struct hci_conn *hci_connect_bis(struct
+ * the start periodic advertising and create BIG commands have
+ * been queued
+ */
+- hci_conn_hash_list_state(hdev, bis_mark_per_adv, PA_LINK,
++ hci_conn_hash_list_state(hdev, bis_mark_per_adv, BIS_LINK,
+ BT_BOUND, &data);
+
+ /* Queue start periodic advertising and create BIG */
--- /dev/null
+From 41bf23338a501e745c398e0faee948dd05d0be98 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 4 Nov 2025 17:02:04 -0500
+Subject: Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 41bf23338a501e745c398e0faee948dd05d0be98 upstream.
+
+Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn:
+Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does
+in fact needs to run bis_cleanup in order to terminate the PA Sync,
+since that is bond to the listening socket which is the entity that
+controls the lifetime of PA Sync, so if it is closed/released the PA
+Sync shall be terminated, terminating the PA Sync shall not result in
+the BIG Sync being terminated since once the later is established it
+doesn't depend on the former anymore.
+
+If the use user wants to reconnect/rebind a number of BIS(s) it shall
+keep the socket open until it no longer needs the PA Sync, which means
+it retains full control of the lifetime of both PA and BIG Syncs.
+
+Fixes: d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK")
+Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_conn.c | 33 +++++++++++++++++++--------------
+ net/bluetooth/hci_event.c | 7 +------
+ net/bluetooth/hci_sync.c | 2 +-
+ 3 files changed, 21 insertions(+), 21 deletions(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -770,21 +770,23 @@ static void find_bis(struct hci_conn *co
+ d->count++;
+ }
+
+-static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *conn)
++static int hci_le_big_terminate(struct hci_dev *hdev, struct hci_conn *conn)
+ {
+ struct iso_list_data *d;
+ int ret;
+
+- bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, conn->sync_handle);
++ bt_dev_dbg(hdev, "hcon %p big 0x%2.2x sync_handle 0x%4.4x", conn,
++ conn->iso_qos.bcast.big, conn->sync_handle);
+
+ d = kzalloc(sizeof(*d), GFP_KERNEL);
+ if (!d)
+ return -ENOMEM;
+
+- d->big = big;
++ d->big = conn->iso_qos.bcast.big;
+ d->sync_handle = conn->sync_handle;
+
+- if (test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) {
++ if (conn->type == PA_LINK &&
++ test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) {
+ hci_conn_hash_list_flag(hdev, find_bis, PA_LINK,
+ HCI_CONN_PA_SYNC, d);
+
+@@ -802,6 +804,9 @@ static int hci_le_big_terminate(struct h
+ d->big_sync_term = true;
+ }
+
++ if (!d->pa_sync_term && !d->big_sync_term)
++ return 0;
++
+ ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
+ terminate_big_destroy);
+ if (ret)
+@@ -844,8 +849,7 @@ static void bis_cleanup(struct hci_conn
+
+ hci_le_terminate_big(hdev, conn);
+ } else {
+- hci_le_big_terminate(hdev, conn->iso_qos.bcast.big,
+- conn);
++ hci_le_big_terminate(hdev, conn);
+ }
+ }
+
+@@ -988,19 +992,20 @@ static struct hci_conn *__hci_conn_add(s
+ conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
+ break;
+ case CIS_LINK:
+- case BIS_LINK:
+- case PA_LINK:
+ /* conn->src should reflect the local identity address */
+ hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+
+- /* set proper cleanup function */
+- if (!bacmp(dst, BDADDR_ANY))
+- conn->cleanup = bis_cleanup;
+- else if (conn->role == HCI_ROLE_MASTER)
++ if (conn->role == HCI_ROLE_MASTER)
+ conn->cleanup = cis_cleanup;
+
+- conn->mtu = hdev->iso_mtu ? hdev->iso_mtu :
+- hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
++ conn->mtu = hdev->iso_mtu;
++ break;
++ case PA_LINK:
++ case BIS_LINK:
++ /* conn->src should reflect the local identity address */
++ hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
++ conn->cleanup = bis_cleanup;
++ conn->mtu = hdev->iso_mtu;
+ break;
+ case SCO_LINK:
+ if (lmp_esco_capable(hdev))
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -7026,14 +7026,9 @@ static void hci_le_big_sync_established_
+ continue;
+ }
+
+- if (ev->status != 0x42) {
++ if (ev->status != 0x42)
+ /* Mark PA sync as established */
+ set_bit(HCI_CONN_PA_SYNC, &bis->flags);
+- /* Reset cleanup callback of PA Sync so it doesn't
+- * terminate the sync when deleting the connection.
+- */
+- conn->cleanup = NULL;
+- }
+
+ bis->sync_handle = conn->sync_handle;
+ bis->iso_qos.bcast.big = ev->handle;
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -7150,7 +7150,7 @@ static void create_pa_complete(struct hc
+
+ hci_dev_lock(hdev);
+
+- if (!hci_conn_valid(hdev, conn))
++ if (hci_conn_valid(hdev, conn))
+ clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
+
+ if (!err)
--- /dev/null
+From d36349ea73d805bb72cbc24ab90cb1da4ad5c379 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Mon, 28 Jul 2025 13:51:01 -0400
+Subject: Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit d36349ea73d805bb72cbc24ab90cb1da4ad5c379 upstream.
+
+Connections with type of PA_LINK shall be considered temporary just to
+track the lifetime of PA Sync setup, once the BIG Sync is established
+and connection are created with BIS_LINK the existing PA_LINK
+connection shall not longer use bis_cleanup otherwise it terminates the
+PA Sync when that shall be left to BIS_LINK connection to do it.
+
+Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_conn.c | 10 +++++++++-
+ net/bluetooth/hci_event.c | 7 ++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -830,7 +830,15 @@ static void bis_cleanup(struct hci_conn
+ /* Check if ISO connection is a BIS and terminate advertising
+ * set and BIG if there are no other connections using it.
+ */
+- bis = hci_conn_hash_lookup_big(hdev, conn->iso_qos.bcast.big);
++ bis = hci_conn_hash_lookup_big_state(hdev,
++ conn->iso_qos.bcast.big,
++ BT_CONNECTED);
++ if (bis)
++ return;
++
++ bis = hci_conn_hash_lookup_big_state(hdev,
++ conn->iso_qos.bcast.big,
++ BT_CONNECT);
+ if (bis)
+ return;
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -7026,9 +7026,14 @@ static void hci_le_big_sync_established_
+ continue;
+ }
+
+- if (ev->status != 0x42)
++ if (ev->status != 0x42) {
+ /* Mark PA sync as established */
+ set_bit(HCI_CONN_PA_SYNC, &bis->flags);
++ /* Reset cleanup callback of PA Sync so it doesn't
++ * terminate the sync when deleting the connection.
++ */
++ conn->cleanup = NULL;
++ }
+
+ bis->sync_handle = conn->sync_handle;
+ bis->iso_qos.bcast.big = ev->handle;
dpll-fix-clock-quality-level-reporting.patch
afs-fix-delayed-allocation-of-a-cell-s-anonymous-key.patch
afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
+bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch
+bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch
+bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch
+bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch
+afs-fix-uninit-var-in-afs_alloc_anon_key.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
