Missing signoff in the bluetooth tree

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 553 bytes --]

Commits

  4712bd9a14cbd ("Bluetooth: btintel: validate DDC record lengths")
  7348abd83a3b2 ("Bluetooth: hci_core: free the HCI ID if naming fails")
  ea983244b99a3 ("Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems")
  2b036342b623c ("Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()")
  6d21e89e69775 ("Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()")
  4145a13c1a044 ("Bluetooth: btintel: fix buffer over-read in btintel_hw_error()")

are missing a Signed-off-by from their committers

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 682 bytes --]

On Wed, Sep 23, 2026 at 10:22:37AM +0200, Mark Brown wrote:
> Commits
> 
>   4712bd9a14cbd ("Bluetooth: btintel: validate DDC record lengths")
>   7348abd83a3b2 ("Bluetooth: hci_core: free the HCI ID if naming fails")
>   ea983244b99a3 ("Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems")
>   2b036342b623c ("Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()")
>   6d21e89e69775 ("Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()")
>   4145a13c1a044 ("Bluetooth: btintel: fix buffer over-read in btintel_hw_error()")
> 
> are missing a Signed-off-by from their committers

This issue is still present today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Luiz Augusto von Dentz]

Weird, this should have been fixed in the last back merge, going in
the list of commits in bluetooth-next
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/log/
they show as:

commit c9c15d4d8956df8c564f7c210e4dc5b9b820d97a (gitolite-bluetooth/master)
Author: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
Date:   Tue Sep 22 18:33:11 2026 +0530

    Bluetooth: btintel: validate DDC record lengths

    Parse DDC record lengths in unsigned storage so 0xFF does not wrap.
    Reject records smaller than the mandatory three-byte header, records
    exceeding U8_MAX, and records exceeding remaining firmware bytes before
    issuing Intel_Write_DDC.

    This issue was reported by Claude Mythos.

    Fixes: 145f2368c5fd ("Bluetooth: btintel: Add Device Configuration support")
    Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

commit d1ac915fb4184faad1b62148be50f317de7c24b5
Author: Sang-Hoon Choi <csh0052@gmail.com>
Date:   Tue Sep 22 03:49:28 2026 +0900

    Bluetooth: hci_core: free the HCI ID if naming fails

    hci_register_dev() allocates an ID before calling dev_set_name().
    If naming fails, it returns without releasing that ID. The device has
    not been registered and hdev->id has not been assigned, so the normal
    unregister path cannot release it.

    Free the allocated ID before returning the naming error.

    Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings")
    Reported-by: Changyul Lee <lcy8047@gmail.com>
    Assisted-by: LLM
    Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
    Reported-by: Changyul Lee <lcy8047@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

commit 74847177eca5638827ab74cdf77f0b10fc40ca6c
Author: Linmao Li <lilinmao@kylinos.cn>
Date:   Tue Sep 22 10:01:41 2026 +0800

    Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems

    On 64-bit systems, outgoing BR/EDR connections always fall back to page
    scan repetition mode R2 with no clock offset once the system has been
    up for more than five minutes, even when inquiry found the peer only
    seconds earlier. This lengthens paging and can increase the risk of a
    Page Timeout.

    The inquiry cache stores jiffies in __u32 timestamps, but its age
    helpers subtract them from unsigned long jiffies. INITIAL_JIFFIES casts
    -300 * HZ through unsigned int, so jiffies crosses 2^32 five minutes
    after boot on 64-bit systems. Assigning it to __u32 then drops the upper
    32 bits. In one trace, a 7.6-second-old entry (HZ=1000) was reported as
    2^32 + 7620 ticks old and rejected by hci_acl_create_conn_sync().
    hci_inquiry() is affected by the same truncation when checking the whole
    cache. 32-bit systems are unaffected because unsigned long is 32 bits
    wide there.

    Use unsigned long for both timestamps so they have the same width as
    jiffies on 32-bit and 64-bit systems, and update the debugfs format
    specifier accordingly.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable@vger.kernel.org
    Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

commit f771f96557a4d953a7e4d045870547271e36e819
Author: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Date:   Tue Sep 22 12:10:22 2026 +0530

    Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

    btintel_pcie_send_frame() eventually copies skb->data into a fixed
    BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in
    btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.
    A user-space process with HCI_CHANNEL_USER access can inject an
    oversized packet and overflow the buffer.

    Reject packets larger than
    BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

    Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup*
function to download firmware")
    Cc: stable@vger.kernel.org
    Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

commit 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea
Author: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Date:   Tue Sep 22 12:10:21 2026 +0530

    Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

    plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen
    is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the
    "skb->len < plen" check and letting skb_trim() truncate the packet.

    Widen plen to u32 so the addition cannot wrap.

    Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for
PCIe transport")
    Cc: stable@vger.kernel.org
    Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

commit 40eb4b18ad167b63644c27fa67a7400ba050379a
Author: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Date:   Tue Sep 22 12:10:20 2026 +0530

    Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

    The "Exception info %s" print uses skb->data + 1, but the 12-byte
    payload is not guaranteed to be NUL-terminated and can be read past
    its end.

    Bound the print with "%.*s" and skb->len - 1.

    Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for
handling hardware errors")
    Cc: stable@vger.kernel.org
    Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

On Mon, Sep 28, 2026 at 10:37 AM Mark Brown <broonie@kernel.org> wrote:
>
> On Wed, Sep 23, 2026 at 10:22:37AM +0200, Mark Brown wrote:
> > Commits
> >
> >   4712bd9a14cbd ("Bluetooth: btintel: validate DDC record lengths")
> >   7348abd83a3b2 ("Bluetooth: hci_core: free the HCI ID if naming fails")
> >   ea983244b99a3 ("Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems")
> >   2b036342b623c ("Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()")
> >   6d21e89e69775 ("Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()")
> >   4145a13c1a044 ("Bluetooth: btintel: fix buffer over-read in btintel_hw_error()")
> >
> > are missing a Signed-off-by from their committers
>
> This issue is still present today.



-- 
Luiz Augusto von Dentz

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 872 bytes --]

On Mon, Sep 28, 2026 at 11:13:19AM -0400, Luiz Augusto von Dentz wrote:
> Weird, this should have been fixed in the last back merge, going in
> the list of commits in bluetooth-next
> https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/log/
> they show as:

> commit c9c15d4d8956df8c564f7c210e4dc5b9b820d97a (gitolite-bluetooth/master)
> Author: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
> Date:   Tue Sep 22 18:33:11 2026 +0530
> 
>     Bluetooth: btintel: validate DDC record lengths

I have this commit but also the older 

4712bd9a14cbdd712fc8584f18be332b9ceb70b0 Bluetooth: btintel: validate DDC record lengths

I didn't spot check all the rest but there's a bunch of what look like
duplicated subjects.  If you did a merge then both the fixed commits and
the original problematic commits will still be in the history.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Luiz Augusto von Dentz]

Hi Mark,

On Mon, Sep 28, 2026 at 12:27 PM Mark Brown <broonie@kernel.org> wrote:
>
> On Mon, Sep 28, 2026 at 11:13:19AM -0400, Luiz Augusto von Dentz wrote:
> > Weird, this should have been fixed in the last back merge, going in
> > the list of commits in bluetooth-next
> > https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/log/
> > they show as:
>
> > commit c9c15d4d8956df8c564f7c210e4dc5b9b820d97a (gitolite-bluetooth/master)
> > Author: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
> > Date:   Tue Sep 22 18:33:11 2026 +0530
> >
> >     Bluetooth: btintel: validate DDC record lengths
>
> I have this commit but also the older
>
> 4712bd9a14cbdd712fc8584f18be332b9ceb70b0 Bluetooth: btintel: validate DDC record lengths
>
> I didn't spot check all the rest but there's a bunch of what look like
> duplicated subjects.  If you did a merge then both the fixed commits and
> the original problematic commits will still be in the history.

Interesting, so back merges seem particularly weak regarding
duplicates. I wonder if there is a merge option that can eliminate
duplicates, since I don't think there is any value in keeping previous
ids if a new merge changes them.

-- 
Luiz Augusto von Dentz

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1005 bytes --]

On Mon, Sep 28, 2026 at 01:03:30PM -0400, Luiz Augusto von Dentz wrote:
> On Mon, Sep 28, 2026 at 12:27 PM Mark Brown <broonie@kernel.org> wrote:

> > I didn't spot check all the rest but there's a bunch of what look like
> > duplicated subjects.  If you did a merge then both the fixed commits and
> > the original problematic commits will still be in the history.

> Interesting, so back merges seem particularly weak regarding
> duplicates. I wonder if there is a merge option that can eliminate
> duplicates, since I don't think there is any value in keeping previous
> ids if a new merge changes them.

No, that's not something that any merge can do - it's one of those
occasions when you need to rewrite history to drop the problematic
stuff, or just decide it's OK to live with it.  I'm not sure if anyone
is actually going to *care* about an example like this where it's fairly
clearly unintentional and there's a second copy with everything in
order, but it'd be nice to fix.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 308 bytes --]

Commits

  e40edfa049b96 ("Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()")
  ee0662ba1e0a5 ("Bluetooth: hci_sync: Serialize local codec list cleanup")
  6691666bb4b22 ("Bluetooth: hci_qca: Do not write to the serial port after it is closed")

are missing a Signed-off-by from their committers

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 429 bytes --]

On Fri, Sep 11, 2026 at 02:21:10PM +0100, Mark Brown wrote:
> Commits
> 
>   e40edfa049b96 ("Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()")
>   ee0662ba1e0a5 ("Bluetooth: hci_sync: Serialize local codec list cleanup")
>   6691666bb4b22 ("Bluetooth: hci_qca: Do not write to the serial port after it is closed")
> 
> are missing a Signed-off-by from their committers

The issues are still present today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 221 bytes --]

Commits

  755cf7adf8dd2 ("Bluetooth: btintel_pcie: unified decoder coredump format")
  61f725843b509 ("Bluetooth: btintel_pcie: add MDBGC multi-buffer DBGC allocation")

are missing a Signed-off-by from their committers

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 345 bytes --]

On Mon, Sep 07, 2026 at 12:01:15PM +0100, Mark Brown wrote:
> Commits
> 
>   755cf7adf8dd2 ("Bluetooth: btintel_pcie: unified decoder coredump format")
>   61f725843b509 ("Bluetooth: btintel_pcie: add MDBGC multi-buffer DBGC allocation")
> 
> are missing a Signed-off-by from their committers

These issues are all still present today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 732 bytes --]

Commits

  71729d60938f4 ("Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset")
  a78f54e23804a ("Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset")
  b3850074b2c49 ("Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev")
  1cdf710cc2a13 ("Bluetooth: btintel_pcie: remove duplicate BTINTEL_PCIE_MAGIC_NUM definition")
  21c3501e5f464 ("Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()")
  860043e482746 ("Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware")
  9aa9447804c7b ("Bluetooth: btbcm: Add Synaptics 4384 chip support")
  29d82dcf72731 ("Bluetooth: dt-bindings: net: bluetooth: add BCM4384")

are missing a Signed-off-by from their committers

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1026 bytes --]

On Fri, Sep 04, 2026 at 05:07:01PM +0100, Mark Brown wrote:
> Commits
> 
>   71729d60938f4 ("Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset")
>   a78f54e23804a ("Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset")
>   b3850074b2c49 ("Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev")
>   1cdf710cc2a13 ("Bluetooth: btintel_pcie: remove duplicate BTINTEL_PCIE_MAGIC_NUM definition")
>   21c3501e5f464 ("Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()")
>   860043e482746 ("Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware")
>   9aa9447804c7b ("Bluetooth: btbcm: Add Synaptics 4384 chip support")
>   29d82dcf72731 ("Bluetooth: dt-bindings: net: bluetooth: add BCM4384")
> 
> are missing a Signed-off-by from their committers

All of the above still appear to be present today.  I see that Luiz
Augusto von Dentz <luiz.von.dentz@intel.com> committed at least some of
these, should they also be a contact for this tree?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 144 bytes --]

Commit

  4fe5ea11ac728 ("Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success")

is missing a Signed-off-by from its committer

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 258 bytes --]

On Thu, May 28, 2026 at 01:03:06PM +0100, Mark Brown wrote:
> Commit
> 
>   4fe5ea11ac728 ("Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success")
> 
> is missing a Signed-off-by from its committer

This issue is still present today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 349 bytes --]

On Mon, Jun 01, 2026 at 07:17:17PM +0100, Mark Brown wrote:
> On Thu, May 28, 2026 at 01:03:06PM +0100, Mark Brown wrote:
> > Commit
> > 
> >   4fe5ea11ac728 ("Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success")
> > 
> > is missing a Signed-off-by from its committer
> 
> This issue is still present today.

and today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Missing signoff in the bluetooth tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 144 bytes --]

Commit

  3149687089e0e ("Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success")

is missing a Signed-off-by from its committer

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]