@@ -68,13 +68,6 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://init \
file://run-ptest \
file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \
- file://0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch \
- file://0001-tools-Work-around-broken-stdin-handling-in-home-made.patch \
- file://0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch \
- file://0001-transport-Fix-set-volume-failure-with-invalid-device.patch \
- file://0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch \
- file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch \
- file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
deleted file mode 100644
@@ -1,42 +0,0 @@
-From b33e923b55e4d0e9d78a83cfcb541fd1f687ef54 Mon Sep 17 00:00:00 2001
-From: Bastien Nocera <hadess@hadess.net>
-Date: Fri, 27 Feb 2026 12:27:17 +0100
-Subject: [PATCH] Revert "shared/shell: Don't init input for non-interactive
- shells"
-
-This reverts commit e73bf582dae60356641a32fc27ae03d359ec4c47.
-
-The fix caused "bluetoothctl list" to not output any text, breaking
-a lot of existing scripts.
-
-Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440346
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54]
-Signed-off-by: Leonardo Costa <leonardo.costa@toradex.com>
----
- src/shared/shell.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/shared/shell.c b/src/shared/shell.c
-index 78d58c513..b061f8001 100644
---- a/src/shared/shell.c
-+++ b/src/shared/shell.c
-@@ -1642,13 +1642,13 @@ static bool shell_quit(void *data)
-
- bool bt_shell_attach(int fd)
- {
-- if (data.mode == MODE_INTERACTIVE) {
-- struct input *input;
-+ struct input *input;
-
-- input = input_new(fd);
-- if (!input)
-- return false;
-+ input = input_new(fd);
-+ if (!input)
-+ return false;
-
-+ if (data.mode == MODE_INTERACTIVE) {
- io_set_read_handler(input->io, input_read, input, NULL);
- io_set_disconnect_handler(input->io, input_hup, input, NULL);
-
deleted file mode 100644
@@ -1,33 +0,0 @@
-From b16441fbb7a24325f7c7d0c5ecedc88b46ddd439 Mon Sep 17 00:00:00 2001
-From: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com>
-Date: Thu, 4 Jun 2026 17:32:27 +0800
-Subject: [PATCH] advertising: Fix sending extra bytes with
- MGMT_OP_ADD_EXT_ADV_DATA
-
-MGMT_OP_ADD_EXT_ADV_DATA expects the command to be of size of
-struct mgmt_cp_add_ext_adv_data not mgmt_cp_add_advertising.
-
-Upstream-Status: Backport [2a6968b40378dca5650e18e03ad0407738c47be5]
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com>
----
- src/advertising.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/advertising.c b/src/advertising.c
-index 8970e65f7..0cb37d4ae 100644
---- a/src/advertising.c
-+++ b/src/advertising.c
-@@ -1487,8 +1487,7 @@ static void add_adv_params_callback(uint8_t status, uint16_t length,
- }
- }
-
-- param_len = sizeof(struct mgmt_cp_add_advertising) + adv_data_len +
-- scan_rsp_len;
-+ param_len = sizeof(*cp) + adv_data_len + scan_rsp_len;
-
- cp = malloc0(param_len);
- if (!cp) {
-2.43.0
-
deleted file mode 100644
@@ -1,59 +0,0 @@
-From 45c167591d04e2dfecf5b4642168e54c23abbd40 Mon Sep 17 00:00:00 2001
-From: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Date: Sun, 26 Apr 2026 21:25:15 +0800
-Subject: [PATCH 2/2] gatt-client: Fix use-after-free caused by reentrant
- client teardown
-
-btd_gatt_client_service_removed() can be called reentrantly via
-bt_gatt_client_unref() after the services queue has already been freed,
-resulting in a use-after-free.
-
-Reset client->ready to false before destroying the services queue to
-prevent reentrant calls from dereferencing freed memory.
-
-This was found with the following backtrace:
-
- #0 match_service_handle ()
- #1 queue_remove_if ()
- #2 queue_remove_all ()
- #3 btd_gatt_client_service_removed ()
- #4 gatt_service_removed ()
- #5 handle_notify ()
- #6 queue_foreach ()
- #7 notify_service_changed ()
- #8 gatt_db_service_destroy ()
- #9 queue_remove_all ()
- #10 gatt_db_clear_range ()
- #11 service_changed_failure ()
- #12 discovery_op_unref ()
- #13 bt_gatt_request_unref ()
- #14 bt_gatt_client_cancel_all ()
- #15 bt_gatt_client_free ()
- #16 bt_gatt_client_unref ()
- #17 bt_gatt_client_free ()
- #18 bt_gatt_client_unref ()
- #19 btd_gatt_client_destroy ()
- #20 device_free ()
-
-Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Upstream-Status: Backport [commit d01616f0c276a441dad8afe4e8f7bb261b26ba0a]
----
- src/gatt-client.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/gatt-client.c b/src/gatt-client.c
-index 374e67c..3baf95c 100644
---- a/src/gatt-client.c
-+++ b/src/gatt-client.c
-@@ -2261,6 +2261,8 @@ void btd_gatt_client_destroy(struct btd_gatt_client *client)
- if (!client)
- return;
-
-+ client->ready = false;
-+
- queue_destroy(client->services, unregister_service);
- queue_destroy(client->all_notify_clients, NULL);
- queue_destroy(client->ios, NULL);
-2.34.1
-
deleted file mode 100644
@@ -1,118 +0,0 @@
-From 646014a6a246fe99df27da12d2de7bcd2e04d0df Mon Sep 17 00:00:00 2001
-From: Wei Deng <wei.deng@oss.qualcomm.com>
-Date: Thu, 4 Jun 2026 15:00:24 +0530
-Subject: [PATCH] profile: Set L2CAP IMTU for OBEX profile listeners
-
-The default_settings entries for OBEX profiles (OPP, FTP, PBAP, MAS,
-MNS) have no imtu field, so ext_start_servers() creates the L2CAP
-listening socket without an explicit IMTU. This causes the socket to
-advertise the L2CAP minimum of 672 bytes in L2CAP_CONFIGURATION_RSP,
-limiting the peer's outgoing PDU size and degrading Rx throughput.
-
-Add an imtu field to default_settings and set it to 32767 for all
-OBEX profiles that use L2CAP. Copy the value in ext_set_defaults()
-and apply it to the listening socket via bt_io_set() after
-bt_io_listen() succeeds.
-
-Signed-off-by: Wei Deng <wei.deng@oss.qualcomm.com>
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/646014a6a246fe99df27da12d2de7bcd2e04d0df]
----
- src/profile.c | 19 +++++++++++++++++--
- 1 file changed, 17 insertions(+), 2 deletions(-)
-
-diff --git a/src/profile.c b/src/profile.c
-index dfc5f7161..65df0f7a0 100644
---- a/src/profile.c
-+++ b/src/profile.c
-@@ -55,6 +55,8 @@
- #define MAS_DEFAULT_CHANNEL 16
- #define MNS_DEFAULT_CHANNEL 17
-
-+#define BT_RX_MTU 32767
-+
- #define BTD_PROFILE_PSM_AUTO -1
- #define BTD_PROFILE_CHAN_AUTO -1
-
-@@ -678,6 +680,7 @@ struct ext_profile {
-
- uint16_t version;
- uint16_t features;
-+ uint16_t imtu;
-
- GSList *records;
- GSList *servers;
-@@ -1423,6 +1426,9 @@ static uint32_t ext_start_servers(struct ext_profile *ext,
- if (psm == 0)
- bt_io_get(io, NULL, BT_IO_OPT_PSM, &psm,
- BT_IO_OPT_INVALID);
-+ if (ext->imtu)
-+ bt_io_set(io, NULL, BT_IO_OPT_IMTU, ext->imtu,
-+ BT_IO_OPT_INVALID);
- l2cap->io = io;
- l2cap->proto = BTPROTO_L2CAP;
- l2cap->psm = psm;
-@@ -2075,6 +2081,7 @@ static struct default_settings {
- struct ext_io *rfcomm);
- uint16_t version;
- uint16_t features;
-+ uint16_t imtu;
- } defaults[] = {
- {
- .uuid = SPP_UUID,
-@@ -2142,6 +2149,7 @@ static struct default_settings {
- .authorize = false,
- .get_record = get_opp_record,
- .version = 0x0102,
-+ .imtu = BT_RX_MTU,
- }, {
- .uuid = OBEX_FTP_UUID,
- .name = "File Transfer",
-@@ -2151,6 +2159,7 @@ static struct default_settings {
- .authorize = true,
- .get_record = get_ftp_record,
- .version = 0x0103,
-+ .imtu = BT_RX_MTU,
- }, {
- .uuid = OBEX_SYNC_UUID,
- .name = "Synchronization",
-@@ -2167,6 +2176,7 @@ static struct default_settings {
- .authorize = true,
- .get_record = get_pse_record,
- .version = 0x0101,
-+ .imtu = BT_RX_MTU,
- }, {
- .uuid = OBEX_PCE_UUID,
- .name = "Phone Book Access Client",
-@@ -2182,7 +2192,8 @@ static struct default_settings {
- .mode = BT_IO_MODE_ERTM,
- .authorize = true,
- .get_record = get_mas_record,
-- .version = 0x0100
-+ .version = 0x0100,
-+ .imtu = BT_RX_MTU,
- }, {
- .uuid = OBEX_MNS_UUID,
- .name = "Message Notification",
-@@ -2191,7 +2202,8 @@ static struct default_settings {
- .mode = BT_IO_MODE_ERTM,
- .authorize = true,
- .get_record = get_mns_record,
-- .version = 0x0104
-+ .version = 0x0104,
-+ .imtu = BT_RX_MTU,
- },
- };
-
-@@ -2249,6 +2261,9 @@ static void ext_set_defaults(struct ext_profile *ext)
- if (settings->features)
- ext->features = settings->features;
-
-+ if (settings->imtu)
-+ ext->imtu = settings->imtu;
-+
- if (settings->name)
- ext->name = g_strdup(settings->name);
- }
-2.34.1
-
deleted file mode 100644
@@ -1,84 +0,0 @@
-From 9ec8cad56e47c0555a056e928e6568d543b3ae0c Mon Sep 17 00:00:00 2001
-From: Mengshi Wu <mengshi.wu@oss.qualcomm.com>
-Date: Wed, 1 Apr 2026 19:30:04 +0800
-Subject: [PATCH v1] src/device: Fix stored gatt cache DB Hash value not update
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There is an asymmetry in behavior: when services are added during
-the same connection (via Service Changed indication), the persistent
-storage (disk) is not updated with the new DB hash, but when services
-are removed, it is updated.
-
-During the same connection, We check DB hash value stored at
-/var/lib/bluetooth/<adaptor addr>/cache/<remote addr>.
-When established connection, the stored DB Hash value is A.Then we
-add new services, the stored DB Hash value is still A which should
-change to B. However, if we remove the existing services, the stored
-DB Hash value changed to C.
-
-When performing addition, it goes like this:
-
-discover_primary_cb()
- └─> gatt_db_insert_service() ← NEW service inserted into db
- └─> gatt_service_added() ← callback fires immediately
- └─> store_gatt_db() ← SAVED TO DISK (hash still OLD)
- ...
- └─> discovery_op_complete(success=true)
- └─> read_db_hash(op) ← sends ATT Read By Type
- └─> [ATT response arrives]
- └─> db_hash_read_cb()
- ├─> gatt_db_attribute_write(op->hash, ...)
- │ └─> hash UPDATED IN MEMORY
- └─> discovery_op_complete(true, 0)
- ├─> [no services to remove, no
- │ store_gatt_db called]
- └─> service_changed_complete()
-
-Whereas removal perform like this:
-discovery_op_complete(success=true) [1st call]
- └─> read_db_hash(op)
- └─> op->hash is NULL → sends ATT request → early return
-...
-[ATT response arrives]
-db_hash_read_cb()
- └─> gatt_db_attribute_write(op->hash, ) ← hash UPDATED IN MEMORY
- └─> discovery_op_complete(true, 0) [2nd call]
- └─> read_db_hash(op) → op->hash already set → returns false
- └─> gatt_db_remove_service()
- └─> gatt_service_removed()
- └─> store_gatt_db() ← SAVED TO DISK (hash is NEW)
-
-There is a timing issue to update DB Hash value.
-
-The gatt_client_service_changed() callback in src/device.c is called
-from service_changed_complete() in gatt-client.c, which is invoked
-after db_hash_read_cb() has already updated the hash. Adding
-store_gatt_db(device) here guarantees the db is persisted with the
-correct, up-to-date hash for both the addition and removal cases.
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/0fd01e98cf94616a5c1c39749314cdd4a1654687]
-Signed-off-by: Mengshi Wu <mengshi.wu@oss.qualcomm.com>
----
- src/device.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/device.c b/src/device.c
-index 3ea683667..cfbde307b 100644
---- a/src/device.c
-+++ b/src/device.c
-@@ -6267,7 +6267,11 @@ static void gatt_client_service_changed(uint16_t start_handle,
- uint16_t end_handle,
- void *user_data)
- {
-+ struct btd_device *device = user_data;
-+
- DBG("start 0x%04x, end: 0x%04x", start_handle, end_handle);
-+
-+ store_gatt_db(device);
- }
-
- static void gatt_debug(const char *str, void *user_data)
---
-2.34.1
@@ -1,4 +1,4 @@
-From d8bbdd8e7166f481429b4999f520cd8306685f03 Mon Sep 17 00:00:00 2001
+From e7407ddb1b52308d4b69036da94bbd6021f0c7ab Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex.kanavin@gmail.com>
Date: Fri, 1 Apr 2016 17:07:34 +0300
Subject: [PATCH] tests: add a target for building tests without running them
@@ -10,10 +10,10 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
1 file changed, 3 insertions(+)
diff --git a/Makefile.am b/Makefile.am
-index 94f625d..a3c3512 100644
+index 76c4ab5..91a6277 100644
--- a/Makefile.am
+++ b/Makefile.am
-@@ -725,6 +725,9 @@ endif
+@@ -812,6 +812,9 @@ endif
TESTS = $(unit_tests)
AM_TESTS_ENVIRONMENT = MALLOC_CHECK_=3 MALLOC_PERTURB_=69
deleted file mode 100644
@@ -1,36 +0,0 @@
-From 21e13976f2e375d701b8b7032ba5c1b2e56c305f Mon Sep 17 00:00:00 2001
-From: Bastien Nocera <hadess@hadess.net>
-Date: Fri, 27 Feb 2026 12:27:18 +0100
-Subject: [PATCH] tools: Work-around broken stdin handling in home-made
- mainloop
-
-bluetoothd has 3 mainloop implementations, one relying on ell, one
-relying on glib, and another home-made.
-
-The home-made mainloop handler use epoll() without any fallbacks, and
-will hang if one tries to epoll() an stdin that redirects from
-/dev/null.
-
-Closes: https://github.com/bluez/bluez/issues/700
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54]
-Signed-off-by: Leonardo Costa <leonardo.costa@toradex.com>
----
- Makefile.tools | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile.tools b/Makefile.tools
-index 589f7c94f..7c52e053f 100644
---- a/Makefile.tools
-+++ b/Makefile.tools
-@@ -531,8 +531,8 @@ tools_obexctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
-
- tools_btmgmt_SOURCES = tools/btmgmt.c src/uuid-helper.c client/display.c \
- client/mgmt.c
--tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-mainloop.la \
-- -lreadline
-+tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-glib.la \
-+ $(GLIB_LIBS) -lreadline
- if DEPRECATED
- noinst_PROGRAMS += attrib/gatttool
-
deleted file mode 100644
@@ -1,46 +0,0 @@
-From 8a80f70c23ca5f93b1db7e3956cc7ee28c1fa767 Mon Sep 17 00:00:00 2001
-From: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Date: Mon, 9 Mar 2026 19:18:26 +0800
-Subject: [PATCH] transport: Fix set volume failure with invalid device volume
-
-When AVRCP is connected before AVDTP, an invalid device volume causes
-the target to reject registration for the EVENT_VOLUME_CHANGED
-notification, which breaks subsequent volume updates.
-
-Fix this by initializing the volume to the maximum value in the AVRCP
-target init path when it is invalid, allowing the controller to
-subscribe to AVRCP_EVENT_VOLUME_CHANGED.
-
-Fixes: fa7828bddd21 ("transport: Fix not being able to initialize volume properly")
-Suggested-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/121e5ca79be559c5374f8a54c6fb6e233e383379]
----
- profiles/audio/avrcp.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
-index 724b46c59..326dfdab7 100644
---- a/profiles/audio/avrcp.c
-+++ b/profiles/audio/avrcp.c
-@@ -4296,9 +4296,16 @@ static void target_init(struct avrcp *session)
- if (target->version < 0x0104)
- return;
-
-- if (avrcp_volume_supported(target))
-+ if (avrcp_volume_supported(target)) {
- session->supported_events |=
- (1 << AVRCP_EVENT_VOLUME_CHANGED);
-+ /* Check if transport volume hasn't been initialized then set it
-+ * to max so it works properly if the controller attempts to
-+ * subscribe to AVRCP_EVENT_VOLUME_CHANGED.
-+ */
-+ if (media_transport_get_a2dp_volume(session->dev) < 0)
-+ media_transport_set_a2dp_volume(session->dev, 127);
-+ }
-
- session->supported_events |=
- (1 << AVRCP_EVENT_ADDRESSED_PLAYER_CHANGED) |
-2.34.1
-
similarity index 95%
rename from meta/recipes-connectivity/bluez5/bluez5_5.86.bb
rename to meta/recipes-connectivity/bluez5/bluez5_5.87.bb
@@ -2,7 +2,7 @@ require bluez5.inc
LDFLAGS += " ${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld', '-Wl,-z,nostart-stop-gc', '', d)}"
-SRC_URI[sha256sum] = "99f144540c6070591e4c53bcb977eb42664c62b7b36cb35a29cf72ded339621d"
+SRC_URI[sha256sum] = "26bdcf2cebd7310c6f598850606b037ef0c515fe6608ebc54d22c50c4c32b35f"
CVE_STATUS[CVE-2020-24490] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes"
CVE_STATUS[CVE-2020-12351] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes"
Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *bluez5* to *5.87* has Succeeded. Next steps: - apply the patch: git am 0001-bluez5-upgrade-5.86-5.87.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 49721e7c248e5e74bc380f370144e0358d1ddfc9 Mon Sep 17 00:00:00 2001 From: Upgrade Helper <auh@yoctoproject.org> Date: Sun, 5 Jul 2026 05:09:14 +0000 Subject: [PATCH] bluez5: upgrade 5.86 -> 5.87 --- meta/recipes-connectivity/bluez5/bluez5.inc | 7 -- ...ell-Don-t-init-input-for-non-interac.patch | 42 ------- ...sending-extra-bytes-with-MGMT_OP_ADD.patch | 33 ----- ...use-after-free-caused-by-reentrant-c.patch | 59 --------- ...2CAP-IMTU-for-OBEX-profile-listeners.patch | 118 ------------------ ...x-stored-gatt-cache-DB-Hash-value-no.patch | 84 ------------- ...et-for-building-tests-without-runnin.patch | 6 +- ...d-broken-stdin-handling-in-home-made.patch | 36 ------ ...t-volume-failure-with-invalid-device.patch | 46 ------- .../bluez5/{bluez5_5.86.bb => bluez5_5.87.bb} | 2 +- 10 files changed, 4 insertions(+), 429 deletions(-) delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch rename meta/recipes-connectivity/bluez5/{bluez5_5.86.bb => bluez5_5.87.bb} (95%)