Debian Patches

Status for bluez/5.88-1

Patch Description Author Forwarded Bugs Origin Last update
work-around-Logitech-diNovo-Edge-keyboard-firmware-i.patch work around Logitech diNovo Edge keyboard firmware issue Nobuhiro Iwamatsu <iwamatsu@debian.org> no debian 2024-04-10
obex-Use-GLib-helper-function-to-manipulate-paths.patch [PATCH 1/5] obex: Use GLib helper function to manipulate paths
Instead of trying to do it by hand. This also makes sure that
relative paths aren't used by the agent.		 Bastien Nocera <hadess@hadess.net> no 2013-11-09
agent-Assert-possible-infinite-loop.patch [PATCH 4/5] agent: Assert possible infinite loop Bastien Nocera <hadess@hadess.net> no 2013-12-09
org.bluez.obex.service.in.patch Don't link to symlinked systemd user service Nobuhiro Iwamatsu <iwamatsu@debian.org> not-needed debian 2017-03-17
main.conf-Add-more-details-Closes-904212.patch main.conf: Add more datails (Closes: #904212) Nobuhiro Iwamatsu <iwamatsu@nigauri.org> no 2018-07-29
Add-HCI_TO_STR-macro-for-FIRMWARE_DIR.patch Add HCI_TO_STR macro for FIRMWARE_DIR
If the macro specified with -D is string, it cannot be expanded and an error
will occur. This adds HCI_TO_STR macro that expands as string and wraps it
when expanding FIRMWARE_DIR.

```
tools/hciattach_bcm43xx.c: In function ‘bcm43xx_init’:
<command-line>: error: expected expression before ‘/’ token
tools/hciattach_bcm43xx.c:352:34: note: in expansion of macro ‘FIRMWARE_DIR’
352 | if (bcm43xx_locate_patch(FIRMWARE_DIR, chip_name, fw_path)) {
| ^~~~~~~~~~~~
```		 Nobuhiro Iwamatsu <iwamatsu@debian.org> no 2023-08-06
0002-hostname-handle-chassis-type-handset.patch [PATCH 2/4] hostname: handle chassis type handset
This also corrects the link to the definition of the base class of
device field.		 Simon Fels <simon.fels@canonical.com> no 2015-10-12
lp1759836.patch hid2hci: Fix udev rules for linux-4.14+
Since commit 1455cf8dbfd0 ("driver core: emit uevents when
device is bound to a driver") the kernel started emitting
"bind" and "unbind" uevents which confuse the hid2hci
udev rules.

The symptoms on an affected machine (Dell E5400 in my case)
include bluetooth devices not appearing and udev hogging
the cpu as it's busy processing a constant stream of these
"bind"+"unbind" uevents.

Change the udev rules not do anything except for "add" and
"change" events. This seems to cure my machine at least.

v2: Don't mess up "change" (Zbyszek)
Fix up the commit message a bit		 Ville Syrjälä <ville.syrjala@linux.intel.com> no debian upstream, https://lore.kernel.org/patchwork/patch/1021109/ 2018-12-04
raspi-bcm43xx-load-firmware.patch Patches for loading the bcm43xx firmware

Disables setting the UART interface speed *before* loading the firmware
(a later call sets the speed of the interface as requested).		 Simon Long <simon@raspberrypi.org> yes 2022-12-06
raspi-bcm43xx-3wire.patch Patches to add BCM43xx 3-wire variant

This patch adds the bcm43xx-3wire variant to the hciattach tool; this is
for use when the mini-UART (which lacks flow-control) is used instead of the
PL011 UART to drive the bluetooth module		 Simon Long <simon@raspberrypi.org> yes 2017-04-05
ubuntu_error_restart.patch restart the service on errors Sebastien Bacher <seb128@ubuntu.com> no 2020-04-03
appstream-metainfo.patch Add AppStream metainfo XML with hardware provide info
This allows isenkram to propose this package when the hardware is
present

https://bugs.debian.org/840013		 Petter Reinholdtsen <pere@hungry.com> no 2024-07-31
eds-3.62.patch fix build with evolution-data-server 3.62
Inspired by
https://gitlab.freedesktop.org/SyncEvolution/syncevolution/-/commit/f4620c2083b7		 Sébastien Noel <sebastien@twolife.be> no 2026-10-05
shared-timeout-Fix-use-after-free-when-a-timeout-removes-.patch shared/timeout: Fix use-after-free when a timeout removes itself
If the callback of a timeout_add() timer removes it, e.g. the tester
test timeout restarting it for teardown, its data is freed before
timeout_callback() reads the id, and the id may already be reused by a
timeout added in the callback, which then gets removed instead.

Keep the data while the callback runs and free it afterwards if it was
removed, and add a unit test for it.

(cherry picked from commit 70197a083fa64cec6fff1aabc75f835aed6bc953)		 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> no upstream, after 5.88 2026-10-30
avrcp-Fix-GetTotalNumberOfItems-command-encoding.patch avrcp: Fix GetTotalNumberOfItems command encoding
GetTotalNumberOfItems only takes the Scope as parameter, but the command
declared 11 parameter bytes and sent 7, which targets such as iPhones
drop, stalling following browsing requests until BROWSING_TIMEOUT.

Also return FALSE on every response error path since the callback is a
gboolean and negative errno values would keep the request pending.

(cherry picked from commit a8067198717b38391ca183ed7f41a69ec4b81b6e)		 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> no upstream, after 5.88 2026-11-05
mpris-proxy-fix-possible-crash.patch mpris-proxy: Fix possible crash on OBEX transfer
find_player_by_obex() and related helpers dereference player->obex and
its inner ->obex proxy without checking for NULL. A player legitimately
carries no OBEX session (player->obex == NULL) in three ordinary cases
and stays on the players list in each:

- register_player(): the remote exposes no ObexPort (no AVRCP cover
art);
- device_property_changed(): the device disconnected;
- obex_proxy_removed(): obexd went away.

find_player_by_obex() is reached from obex_property_changed() on every
Status change of any org.bluez.obex.Transfer1 object. Because
g_dbus_client_new() roots the OBEX client at "/", mpris-proxy proxies
all of obexd's objects, including the server-side transfers obexd
registers at /org/bluez/obex/server/sessionN/transferM for an incoming
push. Those paths never belong to a player; walking the list faults on
the first player whose session is NULL. So any peer pushing a file over
OBEX crashes mpris-proxy as soon as one registered player lacks a
cover-art session (the common configuration).

In addition, connect_obex_session() can leave session->obex NULL after a
failed CreateSession. In that state a Track change carrying an ImgHandle
reaches obex_get_image(), where g_dbus_proxy_get_path(NULL) returns NULL
and "path + strlen(...)" forms a garbage pointer passed to
g_strconcat(), crashing the process.

Guard all four player->obex / session->obex dereference sites, and use
g_clear_pointer() when releasing session->obex so a stale pointer cannot
be reused.

This folds together the fix originally proposed by Bastien Nocera in
https://github.com/bluez/bluez/pull/2098 and the additional inner-proxy
guard tracked in https://github.com/bluez/bluez/issues/2569 and
https://github.com/bluez/bluez/pull/2631, neither of which landed.		 Kai-Chuan Hsieh <kaichuan.hsieh@canonical.com> yes upstream backport, https://github.com/bluez/bluez/pull/2098 2026-11-06

All known versions for source package 'bluez'

Links