Re: [GIT PULL] bluetooth 2026-05-14

On 5/15/26 17:10, Thorsten Leemhuis wrote:
> On 5/14/26 19:23, Luiz Augusto von Dentz wrote:
>
>> The following changes since commit c78bdba7b9666020c0832150a4fc4c0aebc7c6ac:
>>   net: phy: DP83TC811: add reading of abilities (2026-05-14 15:17:12 +0200)
>>
>> are available in the Git repository at:
>>
>>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-14
>>
>> for you to fetch changes up to 375ba7484132662a4a8c7547d088fb6275c00282:
>>
>>   Bluetooth: hci_qca: Convert timeout from jiffies to ms (2026-05-14 09:58:08 -0400)
> 
> It seems this PR sadly came too late for this week's net PR to mainline
> that was merged yesterday.
> 
> TWIMC, from my point of view, it would be great if we somehow could
> still get the changes from this PR or at least the btmtk fix it
> contains[1] to mainline this week before -rc4, as it is fixing a
> regression known since 2026-04-24 that at least five people encountered
> with mainline since -rc3 due to 634a4408c0615c ("Bluetooth: btmtk:
> validate WMT event SKB length before struct access") [006b9943b982 in
> -next].

Greg, Sasha, that [1] fix I was talking about now reached -next as
162b1adeb057d2 ("Bluetooth: btmtk: accept too short WMT FUNC_CTRL
events") and will likely hit mainline on Thursday or so with the weekly
-net PR to -mainline. If that's good enough for you, I'd say it would be
good to pick this up for the next round of stable kernels.

Ciao, Thorsten

P.S.: Side note, in case anyone cares: this regression meanwhile was
reported at least 14 times by now (only counting upstream reports, there
are many more in various downstreams).

> Another reason: Greg a few hours ago backported the culprit for the
> regression to v7.0.7, v6.18.30, and v6.12.88, which led to a bunch of
> other reports coming in[3]. Greg could, of course, revert it, but
> usually he prefers to just merge the fix. But of course the fix must
> first hit mainline (or at least -next) -- and that might only happen
> next Thursday, as there usually is only one net PR per week. Luiz even
> wanted to "expedite a PR to have it fixed asap"[4], but that didn't work
> out afaics, hence this mail.
> 
> Ciao, Thorsten
> 
> [1] btmtk: accept too short WMT FUNC_CTRL events – also available here:
> https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
> 
> [2]
> https://lore.kernel.org/lkml/[email protected]/
> https://lore.kernel.org/lkml/[email protected]/
> https://bugzilla.kernel.org/show_bug.cgi?id=221511
> https://lore.kernel.org/lkml/[email protected]/
> https://lore.kernel.org/lkml/[email protected]/
> (+ one more report in a Fedora kernel chatroom)
> 
> [3]
> https://bugzilla.kernel.org/show_bug.cgi?id=221521
> https://lore.kernel.org/lkml/[email protected]/
> + a four more people in
> https://bodhi.fedoraproject.org/updates/FEDORA-2026-6b173ffc2a#comment-4646633
> 
> [4]
> https://lore.kernel.org/all/CABBYNZ+FfhYtU2=J-V4pjKf_vKV=Y5LhVhxS_epKe-qaUUt8_g@mail.gmail.com/
> 
> 
>> ----------------------------------------------------------------
>> bluetooth pull request for net:
>>
>>  - af_bluetooth: serialize accept_q access
>>  - L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
>>  - btmtk: accept too short WMT FUNC_CTRL events
>>  - hci_qca: Convert timeout from jiffies to ms
>>
>> ----------------------------------------------------------------
>> Jiexun Wang (1):
>>       Bluetooth: serialize accept_q access
>>
>> Michael Bommarito (1):
>>       Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
>>
>> Pauli Virtanen (1):
>>       Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
>>
>> Shuai Zhang (1):
>>       Bluetooth: hci_qca: Convert timeout from jiffies to ms
>>
>>  drivers/bluetooth/btmtk.c         |  4 +-
>>  drivers/bluetooth/hci_qca.c       | 33 +++++++--------
>>  include/net/bluetooth/bluetooth.h |  1 +
>>  net/bluetooth/af_bluetooth.c      | 87 +++++++++++++++++++++++++++++----------
>>  net/bluetooth/l2cap_core.c        |  2 +-
>>  5 files changed, 85 insertions(+), 42 deletions(-)
>>
>