lp:bluez

Branch merges

1 branch proposed for merging into this one.

No branches dependent on this one.

Related source package recipes

7 recipes using this branch. (?)

Related snap packages

Related bugs

Related blueprints

NOTE: Upstream imports have moved. They are done (by hand for now) here:
https://git.launchpad.net/~bluetooth/bluez?h=master

23826. By Pauli Virtanen <email address hidden> on 2025-10-13

doc: enable 6lowpan in tester.config and explain in test-runner.rst

Now that there is a 6lowpan-tester, enable requirements in tester
config, and explain what is needed in test-runner.rst

23825. By Pauli Virtanen <email address hidden> on 2025-10-13

tools: add 6lowpan-tester

Add 6lowpan smoke testing. It only exercises the kernel 6lowpan L2CAP
connection handling, ipv6 testing is mostly out of scope for the tester.

Add tests:

Basic Framework - Success
Client Connect - Terminate
Client Connect - Disable
Client Connect - Disconnect
Client Recv Dgram - Success
Client Recv Raw - Success

23824. By Luiz Augusto von Dentz <email address hidden> on 2025-10-13

bthost: Fix crash on l2cap_ecred_conn_rsp

This fixes the following crash:

Invalid read of size 2
   at 0x4019907: l2cap_ecred_conn_rsp (bthost.c:2554)
   by 0x4019907: l2cap_le_sig (bthost.c:2650)
   by 0x4019907: process_l2cap (bthost.c:3137)
   by 0x401BBA3: process_acl (bthost.c:3242)
   by 0x401BBA3: bthost_receive_h4 (bthost.c:3402)
   by 0x4008835: receive_bthost (bluetooth.c:2989)
   by 0x493B862: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
   by 0x49447A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
   by 0x4944A4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.4)
   by 0x402645D: mainloop_run (mainloop-glib.c:65)
   by 0x4026A34: mainloop_run_with_signal (mainloop-notify.c:196)
   by 0x4025C55: tester_run (tester.c:1084)
   by 0x4002A7B: main (l2cap-tester.c:2799)
 Address 0x400bc02a4 is not stack'd, malloc'd or (recently) free'd

23823. By Pauli Virtanen <email address hidden> on 2025-10-13

bthost: handle L2CAP_FLOW_CONTROL_CREDIT_IND

Parse L2CAP_FLOW_CONTROL_CREDIT_IND and track credits, instead of
sending reject response. Nothing is done with the credit counts
currently.

23822. By Pauli Virtanen <email address hidden> on 2025-10-13

bthost: handle L2CAP_DISCONN_RSP and remove l2cap_conns

Handle L2CAP disconnection response. On receiving disconnection request
or response, remove the associated connection.

Change disconnect handler signature to take also the handle and CID.

23821. By Pauli Virtanen <email address hidden> on 2025-10-13

shared/bap: fix crash when setting initial metadata of a stream

bt_bap_stream_metadata() when stream is IDLE causes IDLE->IDLE
transition and crashes due to UAF. This occurs if SelectProperties
provides a Metadata.

Fix by not updating state if stream is IDLE.

Log:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7ca9d83ec448 thread T0
    #0 0x000000927dce in bt_bap_stream_metadata src/shared/bap.c:6525
    #1 0x00000056ae75 in setup_config profiles/audio/bap.c:1790
    #2 0x00000056b865 in bap_config_setup profiles/audio/bap.c:1831
0x7ca9d83ec448 is located 8 bytes inside of 160-byte region [0x7ca9d83ec440,0x7ca9d83ec4e0)
freed by thread T0 here:
    #0 0x7fc9da2e5beb in free.part.0 (/lib64/libasan.so.8+0xe5beb)
    #1 0x0000008e3481 in bap_stream_free src/shared/bap.c:1259
    #2 0x0000008e4586 in bt_bap_stream_unref src/shared/bap.c:1342
    #3 0x0000008e4b6e in bap_ucast_detach src/shared/bap.c:1366
    #4 0x0000008e6b63 in bap_stream_state_changed src/shared/bap.c:1496
    #5 0x0000008ec17d in bap_ucast_set_state src/shared/bap.c:1857
    #6 0x0000008e75e4 in stream_set_state src/shared/bap.c:1543
    #7 0x0000008f268c in stream_metadata src/shared/bap.c:2250
    #8 0x0000008f2801 in bap_ucast_metadata src/shared/bap.c:2274
    #9 0x000000927d3f in bt_bap_stream_metadata src/shared/bap.c:6523

23820. By Pauli Virtanen <email address hidden> on 2025-10-13

shared/bap: check pac cc and metadata length before use

Don't read past buffer end if device provided bogus values for PAC
caps/metadata lengths.

Use iov pull properly, and also check metadata LTV validity.

23819. By Frédéric Danis <email address hidden> on 2025-10-13

unit/test-hfp: Add incoming call interrupted test

This add the following test:
- /HFP/HF/CIT/BV-01-C
  Verify that HF responds as expected when a normal incoming call
  process is interrupted from the remote party.

23818. By Frédéric Danis <email address hidden> on 2025-10-13

unit/test-hfp: Add incoming call prior to connection test

This add the following test:
- /HFP/HF/ICA/BV-07-C
  Verify that HF can connect to an AG that is receiving an in-coming
  call.

23817. By Frédéric Danis <email address hidden> on 2025-10-13

unit/test-hfp: Add Answer Incoming Call with In-Band Ring tests for HF

This add the following tests:
- /HFP/HF/ICA/BV-01-C
  Verify the incoming call is answered from HF, in-band ring tone.
- /HFP/HF/ICA/BV-02-C
  Verify that the AG can change its in-band ring tone setting.
- /HFP/HF/ICA/BV-03-C
  Verify that the HF alerts of an incoming call using the local ring
  signal regardless of the presence of the in-band ring tone.
- /HFP/HF/ICA/BV-04-C-full
  duplicate of /HFP/HF/ICA/BV-04-C test with full SLC setup.

/HFP/HF/ICA/BV-05-C (Verify that the HF alerts an incoming call using
a locally generated alert signal and can answer an incoming call in
the AG when the AG does not use an in-band ring tone as an alert
mechanism for the HF and the IUT allows an Audio Connection to be
present) is similar to /HFP/HF/TCA/BV-02-C/HFP/HF/ICA/BV-04-C-full for
the HF side.