[PW_SID:1040193] Bluetooth: Perform careful capability checks in hci_sock_bind() #3258

BluezTestBot · 2026-01-09T03:16:55Z

Previously, the HCI_SOCK_TRUSTED flag was set in hci_sock_bind() by
checking capable(CAP_NET_ADMIN). This function verifies that the
current caller of the bind system call has the required capability.

However, this approach is vulnerable to a "confused deputy" attack. A
malicious unprivileged program can open an HCI socket and deliberately
share it with a privileged task (e.g., via file descriptor passing).
If the privileged task is tricked into calling bind() on that socket,
the capable() check will pass, and the socket will be marked as
trusted. The original unprivileged program then retains access to this
now-trusted socket, allowing it to perform privileged operations.

This issue mirrors the vulnerability previously identified and fixed
in hci_sock_ioctl().

Fix this by using sk_capable() instead of capable(). This ensures that
both the task performing the bind and the socket opener must have the
CAP_NET_ADMIN capability before the socket is granted the
HCI_SOCK_TRUSTED status.

Fixes: `f4cdbb3` ("Bluetooth: Handle HCI raw socket transition from unbound to bound")
Signed-off-by: Jerry Wu w.7erry@foxmail.com

Commit 25c150a ("bluetooth: Perform careful capability checks in hci_sock_ioctl()")
fixed CVE-2023-2002. hci_sock_bind contains a similar logic. Would it make sense to
fix it in the same way?

Thank you for spending time reading this. Apologies if I missed anything.

net/bluetooth/hci_sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

…lled up by hw On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw and cannot be controlled by the host. As a result, in case of a firmware crash, the host cannot trigger a cold reset. Instead, the BT controller performs a warm restart on its own, without reloading the firmware. This leads to the controller remaining in IBS_WAKE state, while the host expects it to be in sleep mode. The mismatch causes HCI reset commands to time out. Additionally, the driver does not clear internal flags QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence. If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag is not cleared, so only the first SSR generates a coredump. Tell the driver that the BT controller has undergone a proper restart sequence: - Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR. - Add a 50ms delay to allow the controller to complete its warm reset. - Reset tx_idle_timer to prevent the host from entering TX sleep mode. - Clear memcoredump_flag to allow multiple coredump captures. Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set, which indicates that BT_EN is defined in DTS and cannot be toggled. Refer to the comment in include/net/bluetooth/hci.h for details on HCI_QUIRK_NON_PERSISTENT_SETUP. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

MGMT_SETTING_ISO_BROADCASTER and MGMT_SETTING_ISO_RECEIVER flags are missing from supported_settings although they are in current_settings. Report them also in supported_settings to be consistent. Fixes: ae75336 ("Bluetooth: Check for ISO support in controller") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

conn->le_{tx,rx}_phy is not actually a bitfield as it set by HCI_EV_LE_PHY_UPDATE_COMPLETE it is actually correspond to the current PHY in use not what is supported by the controller, so this introduces different fields (conn->le_{tx,rx}_def_phys) to track what PHYs are supported by the connection. Fixes: eab2404 ("Bluetooth: Add BT_PHY socket option") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This reverts commit 98921db ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly. Fixes: 98921db ("Bluetooth: Use devm_kzalloc in btusb.c file") Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add support for MediaTek7920 0489:e158 /sys/kernel/debug/usb/devices reports for that device: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e158 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Andrew Elatsev <elantsew.andrew@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Switch to the generic PCI power management framework and remove legacy callbacks like .suspend() and .resume(). With the generic framework, the standard PCI related work like: - pci_save/restore_state() - pci_enable/disable_device() - pci_set_power_state() is handled by the PCI core and this driver should implement only hci_bcm4377 specific operations in its respective callback functions. Signed-off-by: Vaibhav Gupta <vaibhavgupta40@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This increases build coverage and allows to drop an #ifdef. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

hci_conn_enter_active_mode() uses queue_delayed_work() with the intention that the work will run after the given timeout. However, queue_delayed_work() does nothing if the work is already queued, so depending on the link policy we may end up putting the connection into idle mode every hdev->idle_timeout ms. Use mod_delayed_work() instead so the work is queued if not already queued, and the timeout is updated otherwise. Signed-off-by: Stefan Sørensen <ssorensen@roku.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The connection link policy is only set when establishing an outgoing ACL connection causing connection idle modes not to be available on incoming connections. Move the setting of the link policy to the creation of the connection so all ACL connection will use the link policy set on the HCI device. Signed-off-by: Stefan Sørensen <ssorensen@roku.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

While the configurable system parameters allow controlling the SNIFF mode parameters, they do not include the idle_timeout parameter responsible for enabling SNIFF mode. Add the idle_timeout parameter to allow controlling the idle timeout of BR/EDR connections. Signed-off-by: Stefan Sørensen <ssorensen@roku.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

…ures 1. Implement LE Event Mask to include events required for LE Channel Sounding 2. Enable Channel Sounding feature bit in the LE Host Supported Features command 3. Define HCI command and event structures necessary for LE Channel Sounding functionality Signed-off-by: Naga Bhavani Akella <naga.akella@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This enables client to use setsockopt(BT_PHY) to set the connection packet type/PHY: Example setting BT_PHY_BR_1M_1SLOT: < HCI Command: Change Conne.. (0x01|0x000f) plen 4 Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) Packet type: 0x331e 2-DH1 may not be used 3-DH1 may not be used DM1 may be used DH1 may be used 2-DH3 may not be used 3-DH3 may not be used 2-DH5 may not be used 3-DH5 may not be used > HCI Event: Command Status (0x0f) plen 4 Change Connection Packet Type (0x01|0x000f) ncmd 1 Status: Success (0x00) > HCI Event: Connection Packet Typ.. (0x1d) plen 5 Status: Success (0x00) Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) Packet type: 0x331e 2-DH1 may not be used 3-DH1 may not be used DM1 may be used DH1 may be used 2-DH3 may not be used 3-DH3 may not be used 2-DH5 may not be used Example setting BT_PHY_LE_1M_TX and BT_PHY_LE_1M_RX: < HCI Command: LE Set PHY (0x08|0x0032) plen 7 Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) All PHYs preference: 0x00 TX PHYs preference: 0x01 LE 1M RX PHYs preference: 0x01 LE 1M PHY options preference: Reserved (0x0000) > HCI Event: Command Status (0x0f) plen 4 LE Set PHY (0x08|0x0032) ncmd 1 Status: Success (0x00) > HCI Event: LE Meta Event (0x3e) plen 6 LE PHY Update Complete (0x0c) Status: Success (0x00) Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) TX PHY: LE 1M (0x01) RX PHY: LE 1M (0x01) Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

WCN7850 will first attempt to use ELF_TYPE_PATCH, and if that fails, it will fall back to TLV_TYPE_PATCH. To code uniformity, move WCN7850 workaround to the caller. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Historically, WCN685x and QCA2066 shared the same firmware files. Now, changes are planned for the firmware that will make it incompatible with QCA2066, so a new firmware name is required for WCN685x. Test Steps: - Boot device - Check the BTFW loading status via dmesg Sanity pass and Test Log: QCA Downloading qca/wcnhpbftfw21.tlv Direct firmware load for qca/wcnhpbftfw21.tlv failed with error -2 QCA Downloading qca/hpbftfw21.tlv Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter. Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise. Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter. The device identifies as: Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio Tested on Realtek 8851BE. Bluetooth works after this change is made. Signed-off-by: Techie Ernie <techieernie@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Enable the PA Sync Lost event mask to ensure PA sync loss is properly reported and handled. Fixes: 485e062 ("Bluetooth: hci_event: Fix not handling PA Sync Lost event") Signed-off-by: Yang Li <yang.li@amlogic.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This renames the PHY fields in bt_iso_io_qos to PHYs (plural) since it represents a bitfield where multiple PHYs can be set and make the same change also to HCI_OP_LE_SET_CIG_PARAMS since both c_phy and p_phy fields are bitfields. This also fixes the assumption that hci_evt_le_cis_established PHYs fields are compatible with bt_iso_io_qos, they are not, the fields in hci_evt_le_cis_established represent just a single PHY value so they need to be converted to bitfield when set in bt_iso_io_qos. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>

Previously, the HCI_SOCK_TRUSTED flag was set in hci_sock_bind() by checking capable(CAP_NET_ADMIN). This function verifies that the current caller of the bind system call has the required capability. However, this approach is vulnerable to a "confused deputy" attack. A malicious unprivileged program can open an HCI socket and deliberately share it with a privileged task (e.g., via file descriptor passing). If the privileged task is tricked into calling bind() on that socket, the capable() check will pass, and the socket will be marked as trusted. The original unprivileged program then retains access to this now-trusted socket, allowing it to perform privileged operations. This issue mirrors the vulnerability previously identified and fixed in hci_sock_ioctl(). Fix this by using sk_capable() instead of capable(). This ensures that both the task performing the bind and the socket opener must have the CAP_NET_ADMIN capability before the socket is granted the HCI_SOCK_TRUSTED status. Fixes: f4cdbb3 ("Bluetooth: Handle HCI raw socket transition from unbound to bound") Signed-off-by: Jerry Wu <w.7erry@foxmail.com>

github-actions · 2026-01-09T03:20:14Z

CheckPatch
Desc: Run checkpatch.pl script
Duration: 0.37 seconds
Result: PENDING

github-actions · 2026-01-09T03:20:15Z

GitLint
Desc: Run gitlint
Duration: 0.27 seconds
Result: PENDING

github-actions · 2026-01-09T03:20:15Z

SubjectPrefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.08 seconds
Result: PASS

github-actions · 2026-01-09T03:20:39Z

BuildKernel
Desc: Build Kernel for Bluetooth
Duration: 19.71 seconds
Result: FAIL
Output:


In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
net/bluetooth/hci_sock.c: In function ‘hci_sock_bind’:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1262:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1262:7: error: too few arguments to function ‘sk_capable’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1430:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1430:7: error: too few arguments to function ‘sk_capable’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
make[4]: *** [scripts/Makefile.build:287: net/bluetooth/hci_sock.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:556: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:556: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2010: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

github-actions · 2026-01-09T03:21:06Z

CheckAllWarning
Desc: Run linux kernel with all warning enabled
Duration: 21.90 seconds
Result: FAIL
Output:


In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
net/bluetooth/hci_sock.c: In function ‘hci_sock_bind’:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1262:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1262:7: error: too few arguments to function ‘sk_capable’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1430:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1430:7: error: too few arguments to function ‘sk_capable’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
make[4]: *** [scripts/Makefile.build:287: net/bluetooth/hci_sock.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:556: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:556: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2010: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

github-actions · 2026-01-09T03:21:34Z

CheckSparse
Desc: Run sparse tool with linux kernel
Duration: 24.29 seconds
Result: FAIL
Output:


net/bluetooth/af_bluetooth.c:248:25: warning: context imbalance in 'bt_accept_enqueue' - different lock contexts for basic block
net/bluetooth/hci_core.c:85:9: warning: context imbalance in '__hci_dev_get' - different lock contexts for basic block
net/bluetooth/hci_core.c: note: in included file (through include/linux/notifier.h, include/linux/memory_hotplug.h, include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, include/linux/radix-tree.h, ...):
./include/linux/srcu.h:389:9: warning: context imbalance in 'hci_dev_put_srcu' - unexpected unlock
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
net/bluetooth/hci_sock.c: In function ‘hci_sock_bind’:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1262:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1262:7: error: too few arguments to function ‘sk_capable’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1430:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1430:7: error: too few arguments to function ‘sk_capable’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
make[4]: *** [scripts/Makefile.build:287: net/bluetooth/hci_sock.o] Error 1
make[4]: *** Waiting for unfinished jobs....
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
./include/net/bluetooth/hci.h:2922:47: warning: array of flexible structures
./include/net/bluetooth/hci.h:3008:43: warning: array of flexible structures
drivers/bluetooth/hci_ag6xx.c:257:24: warning: restricted __le32 degrades to integer
make[3]: *** [scripts/Makefile.build:556: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:556: net] Error 2
make[2]: *** Waiting for unfinished jobs....
drivers/bluetooth/hci_mrvl.c:170:23: warning: restricted __le16 degrades to integer
drivers/bluetooth/hci_mrvl.c:203:23: warning: restricted __le16 degrades to integer
drivers/bluetooth/hci_nokia.c:279:23: warning: incorrect type in assignment (different base types)
drivers/bluetooth/hci_nokia.c:279:23:    expected unsigned short [usertype] baud
drivers/bluetooth/hci_nokia.c:279:23:    got restricted __le16 [usertype]
drivers/bluetooth/hci_nokia.c:282:26: warning: incorrect type in assignment (different base types)
drivers/bluetooth/hci_nokia.c:282:26:    expected unsigned short [usertype] sys_clk
drivers/bluetooth/hci_nokia.c:282:26:    got restricted __le16 [usertype]
make[1]: *** [/github/workspace/src/src/Makefile:2010: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

github-actions · 2026-01-09T03:21:58Z

BuildKernel32
Desc: Build 32bit Kernel for Bluetooth
Duration: 19.71 seconds
Result: FAIL
Output:


In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
net/bluetooth/hci_sock.c: In function ‘hci_sock_bind’:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1262:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1262:7: error: too few arguments to function ‘sk_capable’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1430:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1430:7: error: too few arguments to function ‘sk_capable’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
make[4]: *** [scripts/Makefile.build:287: net/bluetooth/hci_sock.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:556: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:556: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2010: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

github-actions · 2026-01-09T03:30:44Z

TestRunnerSetup
Desc: Setup kernel and bluez for test-runner
Duration: 525.21 seconds
Result: FAIL
Output:

Kernel: 
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
net/bluetooth/hci_sock.c: In function ‘hci_sock_bind’:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1262:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1262:7: error: too few arguments to function ‘sk_capable’
 1262 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
In file included from ./include/linux/capability.h:16,
                 from ./include/linux/fs.h:25,
                 from ./include/linux/compat.h:17,
                 from net/bluetooth/hci_sock.c:26:
./include/uapi/linux/capability.h:205:30: warning: passing argument 1 of ‘sk_capable’ makes pointer from integer without a cast [-Wint-conversion]
  205 | #define CAP_NET_ADMIN        12
      |                              ^~
      |                              |
      |                              int
net/bluetooth/hci_sock.c:1430:18: note: in expansion of macro ‘CAP_NET_ADMIN’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |                  ^~~~~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:36: note: expected ‘const struct sock *’ but argument is of type ‘int’
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |                 ~~~~~~~~~~~~~~~~~~~^~
net/bluetooth/hci_sock.c:1430:7: error: too few arguments to function ‘sk_capable’
 1430 |   if (sk_capable(CAP_NET_ADMIN))
      |       ^~~~~~~~~~
In file included from ./include/net/bluetooth/bluetooth.h:30,
                 from net/bluetooth/hci_sock.c:32:
./include/net/sock.h:3019:6: note: declared here
 3019 | bool sk_capable(const struct sock *sk, int cap);
      |      ^~~~~~~~~~
make[4]: *** [scripts/Makefile.build:287: net/bluetooth/hci_sock.o] Error 1
make[3]: *** [scripts/Makefile.build:556: net/bluetooth] Error 2
make[3]: *** Waiting for unfinished jobs....
make[2]: *** [scripts/Makefile.build:556: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2010: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

github-actions · 2026-01-09T03:30:45Z

TestRunner_l2cap-tester
Desc: Run l2cap-tester with test-runner
Duration: 0.11 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:46Z

TestRunner_iso-tester
Desc: Run iso-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:47Z

TestRunner_bnep-tester
Desc: Run bnep-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:48Z

TestRunner_mgmt-tester
Desc: Run mgmt-tester with test-runner
Duration: 0.11 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:49Z

TestRunner_rfcomm-tester
Desc: Run rfcomm-tester with test-runner
Duration: 0.11 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:50Z

TestRunner_sco-tester
Desc: Run sco-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:51Z

TestRunner_ioctl-tester
Desc: Run ioctl-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:52Z

TestRunner_mesh-tester
Desc: Run mesh-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:52Z

TestRunner_smp-tester
Desc: Run smp-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:53Z

TestRunner_userchan-tester
Desc: Run userchan-tester with test-runner
Duration: 0.10 seconds
Result: FAIL
Output:


Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu: could not open kernel file '/github/workspace/src/src/arch/x86/boot/bzImage': No such file or directory

github-actions · 2026-01-09T03:30:54Z

IncrementalBuild
Desc: Incremental build with the patches in the series
Duration: 0.47 seconds
Result: PENDING

shuaz-shuai and others added 19 commits December 3, 2025 15:03

Bluetooth: btmtksdio: Use pm_ptr instead of #ifdef CONFIG_PM

fd52b1d

This increases build coverage and allows to drop an #ifdef. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

github-actions bot force-pushed the workflow branch 3 times, most recently from e7984f7 to e352d45 Compare January 15, 2026 16:43

github-actions bot force-pushed the workflow branch 4 times, most recently from 3f966d4 to ea4e59a Compare January 26, 2026 23:00

github-actions bot force-pushed the workflow branch 2 times, most recently from b61904b to 21df9a1 Compare January 29, 2026 19:40

[PW_SID:1040193] Bluetooth: Perform careful capability checks in hci_sock_bind() #3258

Are you sure you want to change the base?

[PW_SID:1040193] Bluetooth: Perform careful capability checks in hci_sock_bind() #3258

Uh oh!

Conversation

BluezTestBot commented Jan 9, 2026

Fixes: f4cdbb3 ("Bluetooth: Handle HCI raw socket transition from unbound to bound") Signed-off-by: Jerry Wu w.7erry@foxmail.com

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

Fixes: `f4cdbb3` ("Bluetooth: Handle HCI raw socket transition from unbound to bound")
Signed-off-by: Jerry Wu w.7erry@foxmail.com