From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 13:49:47 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.148~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3e2cd80781acddad7d5b71ac8dd21f64c5323360;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: afs-fix-uninit-var-in-afs_alloc_anon_key.patch bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch --- diff --git a/queue-6.12/afs-fix-uninit-var-in-afs_alloc_anon_key.patch b/queue-6.12/afs-fix-uninit-var-in-afs_alloc_anon_key.patch new file mode 100644 index 0000000000..df8ef5ea3e --- /dev/null +++ b/queue-6.12/afs-fix-uninit-var-in-afs_alloc_anon_key.patch @@ -0,0 +1,45 @@ +From 19eef1d98eeda3745df35839190b7d4a4adea656 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Sat, 29 Nov 2025 00:40:11 +0000 +Subject: afs: Fix uninit var in afs_alloc_anon_key() + +From: David Howells + +commit 19eef1d98eeda3745df35839190b7d4a4adea656 upstream. + +Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it +to cell->anonymous_key. Without this change, the error check may return a +false failure with a bad error number. + +Most of the time this is unlikely to happen because the first encounter +with afs_alloc_anon_key() will usually be from (auto)mount, for which all +subsequent operations must wait - apart from other (auto)mounts. Once the +call->anonymous_key is allocated, all further calls to afs_request_key() +will skip the call to afs_alloc_anon_key() for that cell. + +Fixes: d27c71257825 ("afs: Fix delayed allocation of a cell's anonymous key") +Reported-by: Paulo Alcantra +Signed-off-by: David Howells +Reviewed-by: Paulo Alcantara +cc: Marc Dionne +cc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/security.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/afs/security.c ++++ b/fs/afs/security.c +@@ -26,7 +26,8 @@ static int afs_alloc_anon_key(struct afs + struct key *key; + + mutex_lock(&afs_key_lock); +- if (!cell->anonymous_key) { ++ key = cell->anonymous_key; ++ if (!key) { + key = rxrpc_get_null_key(cell->key_desc); + if (!IS_ERR(key)) + cell->anonymous_key = key; diff --git a/queue-6.12/bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch b/queue-6.12/bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch new file mode 100644 index 0000000000..fb4d2227a4 --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch @@ -0,0 +1,41 @@ +From bfa9d28960ed677d556bdf097073bc3129686229 Mon Sep 17 00:00:00 2001 +From: Pavitra Jha +Date: Thu, 21 May 2026 04:04:14 -0400 +Subject: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() + +From: Pavitra Jha + +commit bfa9d28960ed677d556bdf097073bc3129686229 upstream. + +hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but +returns 0 without freeing it when neither pa_sync_term nor big_sync_term +flags are set after evaluating the PA and BIG sync connection state. + +This early-return path was introduced when hci_le_big_terminate() was +refactored to take struct hci_conn instead of raw u8 parameters, adding +PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue +failure does not cover this path. + +Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") +Cc: stable@vger.kernel.org +Signed-off-by: Pavitra Jha +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_conn.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -804,8 +804,10 @@ static int hci_le_big_terminate(struct h + d->big_sync_term = true; + } + +- if (!d->pa_sync_term && !d->big_sync_term) ++ if (!d->pa_sync_term && !d->big_sync_term) { ++ kfree(d); + return 0; ++ } + + ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d, + terminate_big_destroy); diff --git a/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch b/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch new file mode 100644 index 0000000000..fe876d31f3 --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch @@ -0,0 +1,30 @@ +From 3ba486c5f3ce2c22ffd29c0103404cdbe21912b3 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 29 Jul 2025 12:11:09 -0400 +Subject: Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source + +From: Luiz Augusto von Dentz + +commit 3ba486c5f3ce2c22ffd29c0103404cdbe21912b3 upstream. + +This fixes Broadcaster/Broadcast Source not sending HCI_OP_LE_TERM_BIG +because HCI_CONN_PER_ADV where not being set. + +Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_conn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2277,7 +2277,7 @@ struct hci_conn *hci_connect_bis(struct + * the start periodic advertising and create BIG commands have + * been queued + */ +- hci_conn_hash_list_state(hdev, bis_mark_per_adv, PA_LINK, ++ hci_conn_hash_list_state(hdev, bis_mark_per_adv, BIS_LINK, + BT_BOUND, &data); + + /* Queue start periodic advertising and create BIG */ diff --git a/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch b/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch new file mode 100644 index 0000000000..3ed91d208f --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch @@ -0,0 +1,140 @@ +From 41bf23338a501e745c398e0faee948dd05d0be98 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 4 Nov 2025 17:02:04 -0500 +Subject: Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections + +From: Luiz Augusto von Dentz + +commit 41bf23338a501e745c398e0faee948dd05d0be98 upstream. + +Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn: +Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does +in fact needs to run bis_cleanup in order to terminate the PA Sync, +since that is bond to the listening socket which is the entity that +controls the lifetime of PA Sync, so if it is closed/released the PA +Sync shall be terminated, terminating the PA Sync shall not result in +the BIG Sync being terminated since once the later is established it +doesn't depend on the former anymore. + +If the use user wants to reconnect/rebind a number of BIS(s) it shall +keep the socket open until it no longer needs the PA Sync, which means +it retains full control of the lifetime of both PA and BIG Syncs. + +Fixes: d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") +Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_conn.c | 33 +++++++++++++++++++-------------- + net/bluetooth/hci_event.c | 7 +------ + net/bluetooth/hci_sync.c | 2 +- + 3 files changed, 21 insertions(+), 21 deletions(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -770,21 +770,23 @@ static void find_bis(struct hci_conn *co + d->count++; + } + +-static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *conn) ++static int hci_le_big_terminate(struct hci_dev *hdev, struct hci_conn *conn) + { + struct iso_list_data *d; + int ret; + +- bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, conn->sync_handle); ++ bt_dev_dbg(hdev, "hcon %p big 0x%2.2x sync_handle 0x%4.4x", conn, ++ conn->iso_qos.bcast.big, conn->sync_handle); + + d = kzalloc(sizeof(*d), GFP_KERNEL); + if (!d) + return -ENOMEM; + +- d->big = big; ++ d->big = conn->iso_qos.bcast.big; + d->sync_handle = conn->sync_handle; + +- if (test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) { ++ if (conn->type == PA_LINK && ++ test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) { + hci_conn_hash_list_flag(hdev, find_bis, PA_LINK, + HCI_CONN_PA_SYNC, d); + +@@ -802,6 +804,9 @@ static int hci_le_big_terminate(struct h + d->big_sync_term = true; + } + ++ if (!d->pa_sync_term && !d->big_sync_term) ++ return 0; ++ + ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d, + terminate_big_destroy); + if (ret) +@@ -844,8 +849,7 @@ static void bis_cleanup(struct hci_conn + + hci_le_terminate_big(hdev, conn); + } else { +- hci_le_big_terminate(hdev, conn->iso_qos.bcast.big, +- conn); ++ hci_le_big_terminate(hdev, conn); + } + } + +@@ -988,19 +992,20 @@ static struct hci_conn *__hci_conn_add(s + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; + break; + case CIS_LINK: +- case BIS_LINK: +- case PA_LINK: + /* conn->src should reflect the local identity address */ + hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + +- /* set proper cleanup function */ +- if (!bacmp(dst, BDADDR_ANY)) +- conn->cleanup = bis_cleanup; +- else if (conn->role == HCI_ROLE_MASTER) ++ if (conn->role == HCI_ROLE_MASTER) + conn->cleanup = cis_cleanup; + +- conn->mtu = hdev->iso_mtu ? hdev->iso_mtu : +- hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; ++ conn->mtu = hdev->iso_mtu; ++ break; ++ case PA_LINK: ++ case BIS_LINK: ++ /* conn->src should reflect the local identity address */ ++ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); ++ conn->cleanup = bis_cleanup; ++ conn->mtu = hdev->iso_mtu; + break; + case SCO_LINK: + if (lmp_esco_capable(hdev)) +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -7026,14 +7026,9 @@ static void hci_le_big_sync_established_ + continue; + } + +- if (ev->status != 0x42) { ++ if (ev->status != 0x42) + /* Mark PA sync as established */ + set_bit(HCI_CONN_PA_SYNC, &bis->flags); +- /* Reset cleanup callback of PA Sync so it doesn't +- * terminate the sync when deleting the connection. +- */ +- conn->cleanup = NULL; +- } + + bis->sync_handle = conn->sync_handle; + bis->iso_qos.bcast.big = ev->handle; +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -7150,7 +7150,7 @@ static void create_pa_complete(struct hc + + hci_dev_lock(hdev); + +- if (!hci_conn_valid(hdev, conn)) ++ if (hci_conn_valid(hdev, conn)) + clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); + + if (!err) diff --git a/queue-6.12/bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch b/queue-6.12/bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch new file mode 100644 index 0000000000..98abff6936 --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch @@ -0,0 +1,60 @@ +From d36349ea73d805bb72cbc24ab90cb1da4ad5c379 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Mon, 28 Jul 2025 13:51:01 -0400 +Subject: Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK + +From: Luiz Augusto von Dentz + +commit d36349ea73d805bb72cbc24ab90cb1da4ad5c379 upstream. + +Connections with type of PA_LINK shall be considered temporary just to +track the lifetime of PA Sync setup, once the BIG Sync is established +and connection are created with BIS_LINK the existing PA_LINK +connection shall not longer use bis_cleanup otherwise it terminates the +PA Sync when that shall be left to BIS_LINK connection to do it. + +Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_conn.c | 10 +++++++++- + net/bluetooth/hci_event.c | 7 ++++++- + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -830,7 +830,15 @@ static void bis_cleanup(struct hci_conn + /* Check if ISO connection is a BIS and terminate advertising + * set and BIG if there are no other connections using it. + */ +- bis = hci_conn_hash_lookup_big(hdev, conn->iso_qos.bcast.big); ++ bis = hci_conn_hash_lookup_big_state(hdev, ++ conn->iso_qos.bcast.big, ++ BT_CONNECTED); ++ if (bis) ++ return; ++ ++ bis = hci_conn_hash_lookup_big_state(hdev, ++ conn->iso_qos.bcast.big, ++ BT_CONNECT); + if (bis) + return; + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -7026,9 +7026,14 @@ static void hci_le_big_sync_established_ + continue; + } + +- if (ev->status != 0x42) ++ if (ev->status != 0x42) { + /* Mark PA sync as established */ + set_bit(HCI_CONN_PA_SYNC, &bis->flags); ++ /* Reset cleanup callback of PA Sync so it doesn't ++ * terminate the sync when deleting the connection. ++ */ ++ conn->cleanup = NULL; ++ } + + bis->sync_handle = conn->sync_handle; + bis->iso_qos.bcast.big = ev->handle; diff --git a/queue-6.12/series b/queue-6.12/series index e9cae0f7d3..f2a1ce34cc 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -594,3 +594,8 @@ afs-set-vllist-to-null-if-addr-parsing-fails.patch dpll-fix-clock-quality-level-reporting.patch afs-fix-delayed-allocation-of-a-cell-s-anonymous-key.patch afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch +bluetooth-hci_conn-fix-running-bis_cleanup-for-hci_conn-type-pa_link.patch +bluetooth-hci_conn-fix-not-cleaning-up-broadcaster-broadcast-source.patch +bluetooth-hci_conn-fix-not-cleaning-up-pa_link-connections.patch +bluetooth-hci_conn-fix-memory-leak-in-hci_le_big_terminate.patch +afs-fix-uninit-var-in-afs_alloc_anon_key.patch