diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index 4bf4fce506..8d2e1e8f42 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -68,13 +68,6 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://init \ file://run-ptest \ file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \ - file://0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch \ - file://0001-tools-Work-around-broken-stdin-handling-in-home-made.patch \ - file://0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch \ - file://0001-transport-Fix-set-volume-failure-with-invalid-device.patch \ - file://0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch \ - file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch \ - file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch deleted file mode 100644 index a0271513eb..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b33e923b55e4d0e9d78a83cfcb541fd1f687ef54 Mon Sep 17 00:00:00 2001 -From: Bastien Nocera -Date: Fri, 27 Feb 2026 12:27:17 +0100 -Subject: [PATCH] Revert "shared/shell: Don't init input for non-interactive - shells" - -This reverts commit e73bf582dae60356641a32fc27ae03d359ec4c47. - -The fix caused "bluetoothctl list" to not output any text, breaking -a lot of existing scripts. - -Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440346 - -Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54] -Signed-off-by: Leonardo Costa ---- - src/shared/shell.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/shared/shell.c b/src/shared/shell.c -index 78d58c513..b061f8001 100644 ---- a/src/shared/shell.c -+++ b/src/shared/shell.c -@@ -1642,13 +1642,13 @@ static bool shell_quit(void *data) - - bool bt_shell_attach(int fd) - { -- if (data.mode == MODE_INTERACTIVE) { -- struct input *input; -+ struct input *input; - -- input = input_new(fd); -- if (!input) -- return false; -+ input = input_new(fd); -+ if (!input) -+ return false; - -+ if (data.mode == MODE_INTERACTIVE) { - io_set_read_handler(input->io, input_read, input, NULL); - io_set_disconnect_handler(input->io, input_hup, input, NULL); - diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch deleted file mode 100644 index 0a73741367..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch +++ /dev/null @@ -1,33 +0,0 @@ -From b16441fbb7a24325f7c7d0c5ecedc88b46ddd439 Mon Sep 17 00:00:00 2001 -From: Xiuzhuo Shang -Date: Thu, 4 Jun 2026 17:32:27 +0800 -Subject: [PATCH] advertising: Fix sending extra bytes with - MGMT_OP_ADD_EXT_ADV_DATA - -MGMT_OP_ADD_EXT_ADV_DATA expects the command to be of size of -struct mgmt_cp_add_ext_adv_data not mgmt_cp_add_advertising. - -Upstream-Status: Backport [2a6968b40378dca5650e18e03ad0407738c47be5] -Signed-off-by: Luiz Augusto von Dentz -Signed-off-by: Xiuzhuo Shang ---- - src/advertising.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/src/advertising.c b/src/advertising.c -index 8970e65f7..0cb37d4ae 100644 ---- a/src/advertising.c -+++ b/src/advertising.c -@@ -1487,8 +1487,7 @@ static void add_adv_params_callback(uint8_t status, uint16_t length, - } - } - -- param_len = sizeof(struct mgmt_cp_add_advertising) + adv_data_len + -- scan_rsp_len; -+ param_len = sizeof(*cp) + adv_data_len + scan_rsp_len; - - cp = malloc0(param_len); - if (!cp) { --- -2.43.0 - diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch deleted file mode 100644 index 0fcbc0808a..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 45c167591d04e2dfecf5b4642168e54c23abbd40 Mon Sep 17 00:00:00 2001 -From: Jinwang Li -Date: Sun, 26 Apr 2026 21:25:15 +0800 -Subject: [PATCH 2/2] gatt-client: Fix use-after-free caused by reentrant - client teardown - -btd_gatt_client_service_removed() can be called reentrantly via -bt_gatt_client_unref() after the services queue has already been freed, -resulting in a use-after-free. - -Reset client->ready to false before destroying the services queue to -prevent reentrant calls from dereferencing freed memory. - -This was found with the following backtrace: - - #0 match_service_handle () - #1 queue_remove_if () - #2 queue_remove_all () - #3 btd_gatt_client_service_removed () - #4 gatt_service_removed () - #5 handle_notify () - #6 queue_foreach () - #7 notify_service_changed () - #8 gatt_db_service_destroy () - #9 queue_remove_all () - #10 gatt_db_clear_range () - #11 service_changed_failure () - #12 discovery_op_unref () - #13 bt_gatt_request_unref () - #14 bt_gatt_client_cancel_all () - #15 bt_gatt_client_free () - #16 bt_gatt_client_unref () - #17 bt_gatt_client_free () - #18 bt_gatt_client_unref () - #19 btd_gatt_client_destroy () - #20 device_free () - -Signed-off-by: Jinwang Li -Upstream-Status: Backport [commit d01616f0c276a441dad8afe4e8f7bb261b26ba0a] ---- - src/gatt-client.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/gatt-client.c b/src/gatt-client.c -index 374e67c..3baf95c 100644 ---- a/src/gatt-client.c -+++ b/src/gatt-client.c -@@ -2261,6 +2261,8 @@ void btd_gatt_client_destroy(struct btd_gatt_client *client) - if (!client) - return; - -+ client->ready = false; -+ - queue_destroy(client->services, unregister_service); - queue_destroy(client->all_notify_clients, NULL); - queue_destroy(client->ios, NULL); --- -2.34.1 - diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch deleted file mode 100644 index 332b11464e..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 646014a6a246fe99df27da12d2de7bcd2e04d0df Mon Sep 17 00:00:00 2001 -From: Wei Deng -Date: Thu, 4 Jun 2026 15:00:24 +0530 -Subject: [PATCH] profile: Set L2CAP IMTU for OBEX profile listeners - -The default_settings entries for OBEX profiles (OPP, FTP, PBAP, MAS, -MNS) have no imtu field, so ext_start_servers() creates the L2CAP -listening socket without an explicit IMTU. This causes the socket to -advertise the L2CAP minimum of 672 bytes in L2CAP_CONFIGURATION_RSP, -limiting the peer's outgoing PDU size and degrading Rx throughput. - -Add an imtu field to default_settings and set it to 32767 for all -OBEX profiles that use L2CAP. Copy the value in ext_set_defaults() -and apply it to the listening socket via bt_io_set() after -bt_io_listen() succeeds. - -Signed-off-by: Wei Deng -Upstream-Status: Backport [https://github.com/bluez/bluez/commit/646014a6a246fe99df27da12d2de7bcd2e04d0df] ---- - src/profile.c | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/src/profile.c b/src/profile.c -index dfc5f7161..65df0f7a0 100644 ---- a/src/profile.c -+++ b/src/profile.c -@@ -55,6 +55,8 @@ - #define MAS_DEFAULT_CHANNEL 16 - #define MNS_DEFAULT_CHANNEL 17 - -+#define BT_RX_MTU 32767 -+ - #define BTD_PROFILE_PSM_AUTO -1 - #define BTD_PROFILE_CHAN_AUTO -1 - -@@ -678,6 +680,7 @@ struct ext_profile { - - uint16_t version; - uint16_t features; -+ uint16_t imtu; - - GSList *records; - GSList *servers; -@@ -1423,6 +1426,9 @@ static uint32_t ext_start_servers(struct ext_profile *ext, - if (psm == 0) - bt_io_get(io, NULL, BT_IO_OPT_PSM, &psm, - BT_IO_OPT_INVALID); -+ if (ext->imtu) -+ bt_io_set(io, NULL, BT_IO_OPT_IMTU, ext->imtu, -+ BT_IO_OPT_INVALID); - l2cap->io = io; - l2cap->proto = BTPROTO_L2CAP; - l2cap->psm = psm; -@@ -2075,6 +2081,7 @@ static struct default_settings { - struct ext_io *rfcomm); - uint16_t version; - uint16_t features; -+ uint16_t imtu; - } defaults[] = { - { - .uuid = SPP_UUID, -@@ -2142,6 +2149,7 @@ static struct default_settings { - .authorize = false, - .get_record = get_opp_record, - .version = 0x0102, -+ .imtu = BT_RX_MTU, - }, { - .uuid = OBEX_FTP_UUID, - .name = "File Transfer", -@@ -2151,6 +2159,7 @@ static struct default_settings { - .authorize = true, - .get_record = get_ftp_record, - .version = 0x0103, -+ .imtu = BT_RX_MTU, - }, { - .uuid = OBEX_SYNC_UUID, - .name = "Synchronization", -@@ -2167,6 +2176,7 @@ static struct default_settings { - .authorize = true, - .get_record = get_pse_record, - .version = 0x0101, -+ .imtu = BT_RX_MTU, - }, { - .uuid = OBEX_PCE_UUID, - .name = "Phone Book Access Client", -@@ -2182,7 +2192,8 @@ static struct default_settings { - .mode = BT_IO_MODE_ERTM, - .authorize = true, - .get_record = get_mas_record, -- .version = 0x0100 -+ .version = 0x0100, -+ .imtu = BT_RX_MTU, - }, { - .uuid = OBEX_MNS_UUID, - .name = "Message Notification", -@@ -2191,7 +2202,8 @@ static struct default_settings { - .mode = BT_IO_MODE_ERTM, - .authorize = true, - .get_record = get_mns_record, -- .version = 0x0104 -+ .version = 0x0104, -+ .imtu = BT_RX_MTU, - }, - }; - -@@ -2249,6 +2261,9 @@ static void ext_set_defaults(struct ext_profile *ext) - if (settings->features) - ext->features = settings->features; - -+ if (settings->imtu) -+ ext->imtu = settings->imtu; -+ - if (settings->name) - ext->name = g_strdup(settings->name); - } --- -2.34.1 - diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch deleted file mode 100644 index 69323bdc5e..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 9ec8cad56e47c0555a056e928e6568d543b3ae0c Mon Sep 17 00:00:00 2001 -From: Mengshi Wu -Date: Wed, 1 Apr 2026 19:30:04 +0800 -Subject: [PATCH v1] src/device: Fix stored gatt cache DB Hash value not update -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -There is an asymmetry in behavior: when services are added during -the same connection (via Service Changed indication), the persistent -storage (disk) is not updated with the new DB hash, but when services -are removed, it is updated. - -During the same connection, We check DB hash value stored at -/var/lib/bluetooth//cache/. -When established connection, the stored DB Hash value is A.Then we -add new services, the stored DB Hash value is still A which should -change to B. However, if we remove the existing services, the stored -DB Hash value changed to C. - -When performing addition, it goes like this: - -discover_primary_cb() - └─> gatt_db_insert_service() ← NEW service inserted into db - └─> gatt_service_added() ← callback fires immediately - └─> store_gatt_db() ← SAVED TO DISK (hash still OLD) - ... - └─> discovery_op_complete(success=true) - └─> read_db_hash(op) ← sends ATT Read By Type - └─> [ATT response arrives] - └─> db_hash_read_cb() - ├─> gatt_db_attribute_write(op->hash, ...) - │ └─> hash UPDATED IN MEMORY - └─> discovery_op_complete(true, 0) - ├─> [no services to remove, no - │ store_gatt_db called] - └─> service_changed_complete() - -Whereas removal perform like this: -discovery_op_complete(success=true) [1st call] - └─> read_db_hash(op) - └─> op->hash is NULL → sends ATT request → early return -... -[ATT response arrives] -db_hash_read_cb() - └─> gatt_db_attribute_write(op->hash, ) ← hash UPDATED IN MEMORY - └─> discovery_op_complete(true, 0) [2nd call] - └─> read_db_hash(op) → op->hash already set → returns false - └─> gatt_db_remove_service() - └─> gatt_service_removed() - └─> store_gatt_db() ← SAVED TO DISK (hash is NEW) - -There is a timing issue to update DB Hash value. - -The gatt_client_service_changed() callback in src/device.c is called -from service_changed_complete() in gatt-client.c, which is invoked -after db_hash_read_cb() has already updated the hash. Adding -store_gatt_db(device) here guarantees the db is persisted with the -correct, up-to-date hash for both the addition and removal cases. - -Upstream-Status: Backport [https://github.com/bluez/bluez/commit/0fd01e98cf94616a5c1c39749314cdd4a1654687] -Signed-off-by: Mengshi Wu ---- - src/device.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/device.c b/src/device.c -index 3ea683667..cfbde307b 100644 ---- a/src/device.c -+++ b/src/device.c -@@ -6267,7 +6267,11 @@ static void gatt_client_service_changed(uint16_t start_handle, - uint16_t end_handle, - void *user_data) - { -+ struct btd_device *device = user_data; -+ - DBG("start 0x%04x, end: 0x%04x", start_handle, end_handle); -+ -+ store_gatt_db(device); - } - - static void gatt_debug(const char *str, void *user_data) --- -2.34.1 diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch index cea7c10c3d..0fc15c75a0 100644 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch @@ -1,4 +1,4 @@ -From d8bbdd8e7166f481429b4999f520cd8306685f03 Mon Sep 17 00:00:00 2001 +From e7407ddb1b52308d4b69036da94bbd6021f0c7ab Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Fri, 1 Apr 2016 17:07:34 +0300 Subject: [PATCH] tests: add a target for building tests without running them @@ -10,10 +10,10 @@ Signed-off-by: Alexander Kanavin 1 file changed, 3 insertions(+) diff --git a/Makefile.am b/Makefile.am -index 94f625d..a3c3512 100644 +index 76c4ab5..91a6277 100644 --- a/Makefile.am +++ b/Makefile.am -@@ -725,6 +725,9 @@ endif +@@ -812,6 +812,9 @@ endif TESTS = $(unit_tests) AM_TESTS_ENVIRONMENT = MALLOC_CHECK_=3 MALLOC_PERTURB_=69 diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch deleted file mode 100644 index c362936bc2..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 21e13976f2e375d701b8b7032ba5c1b2e56c305f Mon Sep 17 00:00:00 2001 -From: Bastien Nocera -Date: Fri, 27 Feb 2026 12:27:18 +0100 -Subject: [PATCH] tools: Work-around broken stdin handling in home-made - mainloop - -bluetoothd has 3 mainloop implementations, one relying on ell, one -relying on glib, and another home-made. - -The home-made mainloop handler use epoll() without any fallbacks, and -will hang if one tries to epoll() an stdin that redirects from -/dev/null. - -Closes: https://github.com/bluez/bluez/issues/700 - -Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54] -Signed-off-by: Leonardo Costa ---- - Makefile.tools | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Makefile.tools b/Makefile.tools -index 589f7c94f..7c52e053f 100644 ---- a/Makefile.tools -+++ b/Makefile.tools -@@ -531,8 +531,8 @@ tools_obexctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \ - - tools_btmgmt_SOURCES = tools/btmgmt.c src/uuid-helper.c client/display.c \ - client/mgmt.c --tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-mainloop.la \ -- -lreadline -+tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-glib.la \ -+ $(GLIB_LIBS) -lreadline - if DEPRECATED - noinst_PROGRAMS += attrib/gatttool - diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch deleted file mode 100644 index b5846dec47..0000000000 --- a/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 8a80f70c23ca5f93b1db7e3956cc7ee28c1fa767 Mon Sep 17 00:00:00 2001 -From: Jinwang Li -Date: Mon, 9 Mar 2026 19:18:26 +0800 -Subject: [PATCH] transport: Fix set volume failure with invalid device volume - -When AVRCP is connected before AVDTP, an invalid device volume causes -the target to reject registration for the EVENT_VOLUME_CHANGED -notification, which breaks subsequent volume updates. - -Fix this by initializing the volume to the maximum value in the AVRCP -target init path when it is invalid, allowing the controller to -subscribe to AVRCP_EVENT_VOLUME_CHANGED. - -Fixes: fa7828bddd21 ("transport: Fix not being able to initialize volume properly") -Suggested-by: Luiz Augusto von Dentz -Signed-off-by: Jinwang Li -Upstream-Status: Backport [https://github.com/bluez/bluez/commit/121e5ca79be559c5374f8a54c6fb6e233e383379] ---- - profiles/audio/avrcp.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c -index 724b46c59..326dfdab7 100644 ---- a/profiles/audio/avrcp.c -+++ b/profiles/audio/avrcp.c -@@ -4296,9 +4296,16 @@ static void target_init(struct avrcp *session) - if (target->version < 0x0104) - return; - -- if (avrcp_volume_supported(target)) -+ if (avrcp_volume_supported(target)) { - session->supported_events |= - (1 << AVRCP_EVENT_VOLUME_CHANGED); -+ /* Check if transport volume hasn't been initialized then set it -+ * to max so it works properly if the controller attempts to -+ * subscribe to AVRCP_EVENT_VOLUME_CHANGED. -+ */ -+ if (media_transport_get_a2dp_volume(session->dev) < 0) -+ media_transport_set_a2dp_volume(session->dev, 127); -+ } - - session->supported_events |= - (1 << AVRCP_EVENT_ADDRESSED_PLAYER_CHANGED) | --- -2.34.1 - diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.86.bb b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb similarity index 95% rename from meta/recipes-connectivity/bluez5/bluez5_5.86.bb rename to meta/recipes-connectivity/bluez5/bluez5_5.87.bb index 8974a2c69c..75b765d524 100644 --- a/meta/recipes-connectivity/bluez5/bluez5_5.86.bb +++ b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb @@ -2,7 +2,7 @@ require bluez5.inc LDFLAGS += " ${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld', '-Wl,-z,nostart-stop-gc', '', d)}" -SRC_URI[sha256sum] = "99f144540c6070591e4c53bcb977eb42664c62b7b36cb35a29cf72ded339621d" +SRC_URI[sha256sum] = "26bdcf2cebd7310c6f598850606b037ef0c515fe6608ebc54d22c50c4c32b35f" CVE_STATUS[CVE-2020-24490] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes" CVE_STATUS[CVE-2020-12351] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes"