1. 25 Apr, 2023 22 commits
  2. 24 Apr, 2023 18 commits
    • Jakub Kicinski's avatar
      Merge tag 'nf-next-23-04-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next · ffcddcae
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter/IPVS updates for net-next
      
      1) Reduce jumpstack footprint: Stash chain in last rule marker in blob for
         tracing. Remove last rule and chain from jumpstack. From Florian Westphal.
      
      2) nf_tables validates all tables before committing the new rules.
         Unfortunately, this has two drawbacks:
      
         - Since addition of the transaction mutex pernet state gets written to
           outside of the locked section from the cleanup callback, this is
           wrong so do this cleanup directly after table has passed all checks.
      
         - Revalidate tables that saw no changes. This can be avoided by
           keeping the validation state per table, not per netns.
      
         From Florian Westphal.
      
      3) Get rid of a few redundant pointers in the traceinfo structure.
         The three removed pointers are used in the expression evaluation loop,
         so gcc keeps them in registers. Passing them to the (inlined) helpers
         thus doesn't increase nft_do_chain text size, while stack is reduced
         by another 24 bytes on 64bit arches. From Florian Westphal.
      
      4) IPVS cleanups in several ways without implementing any functional
         changes, aside from removing some debugging output:
      
         - Update width of source for ip_vs_sync_conn_options
           The operation is safe, use an annotation to describe it properly.
      
         - Consistently use array_size() in ip_vs_conn_init()
           It seems better to use helpers consistently.
      
         - Remove {Enter,Leave}Function. These seem to be well past their
           use-by date.
      
         - Correct spelling in comments.
      
         From Simon Horman.
      
      5) Extended netlink error report for netdevice in flowtables and
         netdev/chains. Allow for incrementally add/delete devices to netdev
         basechain. Allow to create netdev chain without device.
      
      * tag 'nf-next-23-04-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
        netfilter: nf_tables: allow to create netdev chain without device
        netfilter: nf_tables: support for deleting devices in an existing netdev chain
        netfilter: nf_tables: support for adding new devices to an existing netdev chain
        netfilter: nf_tables: rename function to destroy hook list
        netfilter: nf_tables: do not send complete notification of deletions
        netfilter: nf_tables: extended netlink error reporting for netdevice
        ipvs: Correct spelling in comments
        ipvs: Remove {Enter,Leave}Function
        ipvs: Consistently use array_size() in ip_vs_conn_init()
        ipvs: Update width of source for ip_vs_sync_conn_options
        netfilter: nf_tables: do not store rule in traceinfo structure
        netfilter: nf_tables: do not store verdict in traceinfo structure
        netfilter: nf_tables: do not store pktinfo in traceinfo structure
        netfilter: nf_tables: remove unneeded conditional
        netfilter: nf_tables: make validation state per table
        netfilter: nf_tables: don't write table validation state without mutex
        netfilter: nf_tables: don't store chain address on jump
        netfilter: nf_tables: don't store address of last rule on jump
        netfilter: nf_tables: merge nft_rules_old structure and end of ruleblob marker
      ====================
      
      Link: https://lore.kernel.org/r/20230421235021.216950-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ffcddcae
    • Yafang Shao's avatar
      bpf: Add __rcu_read_{lock,unlock} into btf id deny list · a0c109dc
      Yafang Shao authored
      The tracing recursion prevention mechanism must be protected by rcu, that
      leaves __rcu_read_{lock,unlock} unprotected by this mechanism. If we trace
      them, the recursion will happen. Let's add them into the btf id deny list.
      
      When CONFIG_PREEMPT_RCU is enabled, it can be reproduced with a simple bpf
      program as such:
        SEC("fentry/__rcu_read_lock")
        int fentry_run()
        {
            return 0;
        }
      Signed-off-by: default avatarYafang Shao <laoar.shao@gmail.com>
      Link: https://lore.kernel.org/r/20230424161104.3737-2-laoar.shao@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      a0c109dc
    • Dave Marchevsky's avatar
      bpf: Disable bpf_refcount_acquire kfunc calls until race conditions are fixed · 7deca5ea
      Dave Marchevsky authored
      As reported by Kumar in [0], the shared ownership implementation for BPF
      programs has some race conditions which need to be addressed before it
      can safely be used. This patch does so in a minimal way instead of
      ripping out shared ownership entirely, as proper fixes for the issues
      raised will follow ASAP, at which point this patch's commit can be
      reverted to re-enable shared ownership.
      
      The patch removes the ability to call bpf_refcount_acquire_impl from BPF
      programs. Programs can only bump refcount and obtain a new owning
      reference using this kfunc, so removing the ability to call it
      effectively disables shared ownership.
      
      Instead of changing success / failure expectations for
      bpf_refcount-related selftests, this patch just disables them from
      running for now.
      
        [0]: https://lore.kernel.org/bpf/d7hyspcow5wtjcmw4fugdgyp3fwhljwuscp3xyut5qnwivyeru@ysdq543otzv2/Reported-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
      Signed-off-by: default avatarDave Marchevsky <davemarchevsky@fb.com>
      Link: https://lore.kernel.org/r/20230424204321.2680232-1-davemarchevsky@fb.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      7deca5ea
    • David S. Miller's avatar
      Merge tag 'for-net-next-2023-04-23' of... · 2efb07b5
      David S. Miller authored
      Merge tag 'for-net-next-2023-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
      
      bluetooth-next pull request for net-next:
      
       - Introduce devcoredump support
       - Add support for Realtek RTL8821CS, RTL8851B, RTL8852BS
       - Add support for Mediatek MT7663, MT7922
       - Add support for NXP w8997
       - Add support for Actions Semi ATS2851
       - Add support for QTI WCN6855
       - Add support for Marvell 88W8997
      2efb07b5
    • Luiz Augusto von Dentz's avatar
      Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running · d883a466
      Luiz Augusto von Dentz authored
      This makes sure hci_cmd_sync_queue only queue new work if HCI_RUNNING
      has been set otherwise there is a risk of commands being sent while
      turning off.
      
      Because hci_cmd_sync_queue can no longer queue work while HCI_RUNNING is
      not set it cannot be used to power on adapters so instead
      hci_cmd_sync_submit is introduced which bypass the HCI_RUNNING check, so
      it behaves like the old implementation.
      
      Link: https://lore.kernel.org/all/CAB4PzUpDMvdc8j2MdeSAy1KkAE-D3woprCwAdYWeOc-3v3c9Sw@mail.gmail.com/Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      d883a466
    • Tim Jiang's avatar
      Bluetooth: btusb: Add WCN6855 devcoredump support · 20981ce2
      Tim Jiang authored
      WCN6855 will report memdump via ACL data or HCI event when
      it get crashed, so we collect memdump to debug firmware.
      Signed-off-by: default avatarTim Jiang <quic_tjiang@quicinc.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      20981ce2
    • Neeraj Sanjay Kale's avatar
      Bluetooth: btnxpuart: Enable flow control before checking boot signature · b0310d6e
      Neeraj Sanjay Kale authored
      This enables flow control before checking for bootloader signature and
      deciding whether FW download is needed or not. In case of V1 bootloader
      chips w8987 and w8997, it is observed that if WLAN FW is downloaded first
      and power save is enabled in wlan core, bootloader signatures are not
      emitted by the BT core when the chip is put to sleep. As a result, the
      driver skips FW download and subsequent HCI commands get timeout errors
      in dmesg as shown below:
      
      [  112.898867] Bluetooth: hci0: Opcode 0x c03 failed: -110
      [  114.914865] Bluetooth: hci0: Setting baudrate failed (-110)
      [  116.930856] Bluetooth: hci0: Setting wake-up method failed (-110)
      
      By enabling the flow control, the host enables its RTS pin, and an
      interrupt in chip's UART peripheral causes the bootloader to wake up,
      enabling the bootloader signatures, which then helps in downloading
      the bluetooth FW file.
      
      This changes all instances of 0/1 for serdev_device_set_flow_control()
      to false/true.
      Signed-off-by: default avatarNeeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      b0310d6e
    • Archie Pusaka's avatar
      Bluetooth: Cancel sync command before suspend and power off · f4198635
      Archie Pusaka authored
      Some of the sync commands might take a long time to complete, e.g.
      LE Create Connection when the peer device isn't responding might take
      20 seconds before it times out. If suspend command is issued during
      this time, it will need to wait for completion since both commands are
      using the same sync lock.
      
      This patch cancel any running sync commands before attempting to
      suspend or adapter power off.
      Signed-off-by: default avatarArchie Pusaka <apusaka@chromium.org>
      Reviewed-by: default avatarYing Hsu <yinghsu@chromium.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      f4198635
    • Max Chou's avatar
      Bluetooth: btrtl: Add the support for RTL8851B · 7948fe1c
      Max Chou authored
      Add the support for RTL8851B BT controller on USB interface.
      The necessary firmware will be submitted to linux-firmware project.
      
      Note that the Bluetooth devices WITH the VID=0x0bda would be set the
      feature quirk in btrtl_setup_realtek(). It's able to ignore the
      feature flag set for the specific VID and PID in blacklist_table[] of
      btusb.c. (check [1])
      
      If Realtek Bluetooth chips WITHOUT the VID=0x0bda, it shall be added
      the feature flag for the specific VID and PID in blacklist_table[] of
      btusb.c. (check [2])
      
      [1] '9ab9235f ("Bluetooth: btrtl: Enable WBS for the specific
          Realtek devices")'
      [2] '73280f13 ("Bluetooth: btusb: Add the more support IDs for
          Realtek RTL8822CE")'
      
      The device info from /sys/kernel/debug/usb/devices as below.
      
      T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 33 Spd=480  MxCh= 0
      D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0bda ProdID=b851 Rev= 0.00
      S:  Manufacturer=Realtek
      S:  Product=802.11ax WLAN Adapter
      S:  SerialNumber=00E04C885A01
      C:* #Ifs= 3 Cfg#= 1 Atr=80 MxPwr=500mA
      A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      Signed-off-by: default avatarMax Chou <max.chou@realtek.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      7948fe1c
    • Luiz Augusto von Dentz's avatar
      Bluetooth: btnxpuart: Fix sparse warnings · 9e080b53
      Luiz Augusto von Dentz authored
      This fixes the following sparse warnings:
      
         drivers/bluetooth/btnxpuart.c:681:23: sparse: sparse:
         restricted __le16 degrades to integer
         drivers/bluetooth/btnxpuart.c:690:82: sparse:
         sparse: incorrect type in argument 2 (different base types)
         @@     expected unsigned short [usertype] req_len
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:690:82: sparse:
         expected unsigned short [usertype] req_len
         drivers/bluetooth/btnxpuart.c:690:82: sparse:
         got restricted __le16 [usertype] len
         drivers/bluetooth/btnxpuart.c:694:84: sparse:
         sparse: incorrect type in argument 2 (different base types)
         @@     expected unsigned short [usertype] req_len
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:694:84: sparse:
         expected unsigned short [usertype] req_len
         drivers/bluetooth/btnxpuart.c:694:84: sparse:
         got restricted __le16 [usertype] len
         drivers/bluetooth/btnxpuart.c:708:23: sparse:
         sparse: incorrect type in assignment (different base types)
         @@     expected unsigned int [usertype] requested_len
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:708:23: sparse:
         expected unsigned int [usertype] requested_len
         drivers/bluetooth/btnxpuart.c:708:23: sparse:
         got restricted __le16 [usertype] len
         drivers/bluetooth/btnxpuart.c:787:78: sparse:
         sparse: incorrect type in argument 2 (different base types)
         @@     expected unsigned short [usertype] chipid
         @@     got restricted __le16 [usertype] chip_id @@
         drivers/bluetooth/btnxpuart.c:787:78: sparse:
         expected unsigned short [usertype] chipid
         drivers/bluetooth/btnxpuart.c:787:78: sparse:
         got restricted __le16 [usertype] chip_id
         drivers/bluetooth/btnxpuart.c:810:74: sparse:
         sparse: incorrect type in argument 2 (different base types)
         @@     expected unsigned short [usertype] req_len
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:810:74: sparse:
         expected unsigned short [usertype] req_len
         drivers/bluetooth/btnxpuart.c:810:74: sparse:
         got restricted __le16 [usertype] len
         drivers/bluetooth/btnxpuart.c:815:76: sparse:
         sparse: incorrect type in argument 2 (different base types)
         @@     expected unsigned short [usertype] req_len
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:815:76: sparse:
         expected unsigned short [usertype] req_len
         drivers/bluetooth/btnxpuart.c:815:76: sparse:
         got restricted __le16 [usertype] len
         drivers/bluetooth/btnxpuart.c:834:16: sparse:
         sparse: restricted __le32 degrades to integer
         drivers/bluetooth/btnxpuart.c:843:55: sparse:
         sparse: restricted __le32 degrades to integer
         drivers/bluetooth/btnxpuart.c:844:36: sparse:
         sparse: incorrect type in argument 3 (different base types)
         @@     expected unsigned long [usertype]
         @@     got restricted __le16 [usertype] len @@
         drivers/bluetooth/btnxpuart.c:844:36: sparse:
         expected unsigned long [usertype]
         drivers/bluetooth/btnxpuart.c:844:36: sparse:
         got restricted __le16 [usertype] len
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Link: https://lore.kernel.org/oe-kbuild-all/202304160736.Tsa0zTBU-lkp@intel.com/Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      9e080b53
    • Max Chou's avatar
      Bluetooth: btrtl: Firmware format v2 support · 9a24ce5e
      Max Chou authored
      Realtek changed the format of the firmware file as v2. The driver
      should implement the patch to extract the firmware data from the
      firmware file. The future chips must apply this patch for firmware loading.
      This patch is compatible with the both previous format and v2 as well.
      Signed-off-by: default avatarAllen Chen <allen_chen@realsil.com.cn>
      Signed-off-by: default avatarAlex Lu <alex_lu@realsil.com.cn>
      Tested-by: default avatarHilda Wu <hildawu@realtek.com>
      Signed-off-by: default avatarMax Chou <max.chou@realtek.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      9a24ce5e
    • Zijun Hu's avatar
      Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue · 0ab905c3
      Zijun Hu authored
      API hci_devcd_init() stores its u32 type parameter @dump_size into
      skb, but it does not specify which byte order is used to store the
      integer, let us take little endian to store and parse the integer.
      
      Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump")
      Signed-off-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      0ab905c3
    • Ruihan Li's avatar
      bluetooth: Perform careful capability checks in hci_sock_ioctl() · 25c150ac
      Ruihan Li authored
      Previously, capability was checked using capable(), which verified that the
      caller of the ioctl system call had the required capability. In addition,
      the result of the check would be stored in the HCI_SOCK_TRUSTED flag,
      making it persistent for the socket.
      
      However, malicious programs can abuse this approach by deliberately sharing
      an HCI socket with a privileged task. The HCI socket will be marked as
      trusted when the privileged task occasionally makes an ioctl call.
      
      This problem can be solved by using sk_capable() to check capability, which
      ensures that not only the current task but also the socket opener has the
      specified capability, thus reducing the risk of privilege escalation
      through the previously identified vulnerability.
      
      Cc: stable@vger.kernel.org
      Fixes: f81f5b2d ("Bluetooth: Send control open and close messages for HCI raw sockets")
      Signed-off-by: default avatarRuihan Li <lrh2000@pku.edu.cn>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      25c150ac
    • Min Li's avatar
      Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp · 25e97f7b
      Min Li authored
      conn->chan_lock isn't acquired before l2cap_get_chan_by_scid,
      if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance'
      is triggered.
      
      Reported-by: syzbot+9519d6b5b79cf7787cf3@syzkaller.appspotmail.com
      Link: https://lore.kernel.org/all/000000000000894f5f05f95e9f4d@google.com/Signed-off-by: default avatarMin Li <lm0963hack@gmail.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      25e97f7b
    • Ruihan Li's avatar
      bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() · 000c2fa2
      Ruihan Li authored
      Previously, channel open messages were always sent to monitors on the first
      ioctl() call for unbound HCI sockets, even if the command and arguments
      were completely invalid. This can leave an exploitable hole with the abuse
      of invalid ioctl calls.
      
      This commit hardens the ioctl processing logic by first checking if the
      command is valid, and immediately returning with an ENOIOCTLCMD error code
      if it is not. This ensures that ioctl calls with invalid commands are free
      of side effects, and increases the difficulty of further exploitation by
      forcing exploitation to find a way to pass a valid command first.
      Signed-off-by: default avatarRuihan Li <lrh2000@pku.edu.cn>
      Co-developed-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      000c2fa2
    • Liu Jian's avatar
      Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" · db2bf510
      Liu Jian authored
      This reverts commit 1e9ac114.
      
      This patch introduces a possible null-ptr-def problem. Revert it. And the
      fixed bug by this patch have resolved by commit 73f7b171 ("Bluetooth:
      btsdio: fix use after free bug in btsdio_remove due to race condition").
      
      Fixes: 1e9ac114 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work")
      Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      db2bf510
    • Raul Cheleguini's avatar
      Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 · 91b6d02d
      Raul Cheleguini authored
      The ATS2851 based controller advertises support for command "LE Set Random
      Private Address Timeout" but does not actually implement it, impeding the
      controller initialization.
      
      Add the quirk HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT to unblock the controller
      initialization.
      
      < HCI Command: LE Set Resolvable Private... (0x08|0x002e) plen 2
              Timeout: 900 seconds
      > HCI Event: Command Status (0x0f) plen 4
            LE Set Resolvable Private Address Timeout (0x08|0x002e) ncmd 1
              Status: Unknown HCI Command (0x01)
      Co-developed-by: default avatarimoc <wzj9912@gmail.com>
      Signed-off-by: default avatarimoc <wzj9912@gmail.com>
      Signed-off-by: default avatarRaul Cheleguini <raul.cheleguini@gmail.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      91b6d02d
    • Luiz Augusto von Dentz's avatar
      Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED · c09b80be
      Luiz Augusto von Dentz authored
      When submitting HCI_OP_LE_CREATE_CIS the code shall wait for
      HCI_EVT_LE_CIS_ESTABLISHED thus enforcing the serialization of
      HCI_OP_LE_CREATE_CIS as the Core spec does not allow to send them in
      parallel:
      
        BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2566:
      
        If the Host issues this command before all the HCI_LE_CIS_Established
        events from the previous use of the command have been generated, the
        Controller shall return the error code Command Disallowed (0x0C).
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      c09b80be