From nobody Sat Jul 25 03:48:00 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 758D32FD69E for ; Sun, 19 Jul 2026 20:29:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784492964; cv=none; b=OW0TG0TSEBobgOXgNfIkHakg44dPdPZJCmCo7WjZCMdcwDuSno4V51Z+FJrXlFAGUh/a8TYMRn0YGh5omyFx8EYLHDam9CzuXaVmIyrFfY5t3DZMg+YsIA/5BEASj0KeYb85YTBbtzzHb8RR7ycd+1Y6NqG9Tzu9zM4TFMmCo28= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784492964; c=relaxed/simple; bh=R7AT8adOvT4/AH3JICLJV6MltSIZYnP7VUK8JG3GdPw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=gTYuZi2ldqD6IEBBPew4wacYGGjK8V64Ag7nvbWPcoAGm8f93VTeHUUoRKp2GinkmOTVGyAi3ySxI/9LrqryYvt3CqBffnFVjZfz1/4SrQsOFlOUaSNOWiGFMOmaP78jo7paP1ye6HjzKTJE7amF5KX3OGolLLKKOIlqRU/jarM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=avkA48eG; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=eEbK/wPD; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="avkA48eG"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="eEbK/wPD" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66JKQfPD595084 for ; Sun, 19 Jul 2026 20:29:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=vyJ+vPMAWzCgV2xdQvJUUb 61M5Tx5kuqql1lltVsoNs=; b=avkA48eGLhy4cN3cjD374tT8BQSU1EcE/FehgJ oQPY/PrEB6Ff5ulybGQ4OLJ4Gh0iXR7Arah28JFSZ/g0TWRXtDeUolPHjg5Iaoza bgrRhac06QWts9PxRr+/lsKGLG3aOw1tcAeEUaHupXQD8iAXToJGU+kQatF8jmD0 lnWuf7sIY/1yEqtJHOuGPQlQ5iq5AIYXflTaApmdaxN9D3OSrPh2SxoEhCKiasM1 hVCCyZBIe2XSQyrLWcChVXekqg5d+xfvleg+pD9lqVScpu8R1P8/Fz2lVRa8cQQu 9e0Kf+X0T2GPwrgdALqSKwi2YEb+xYj5IPLfCIPnIHG8ZDUw== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fg2d93d4s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sun, 19 Jul 2026 20:29:22 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2ced1ed870fso20056095ad.2 for ; Sun, 19 Jul 2026 13:29:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784492962; x=1785097762; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=vyJ+vPMAWzCgV2xdQvJUUb61M5Tx5kuqql1lltVsoNs=; b=eEbK/wPDlHYE0Qhm9SdEgsIo/FNY22M0ql/Xwfh6erwFUdtUf6pqwaHFz5xlz0n3rb ukrtUKe5U3XSAzJKBMEr0Pky+KVWxYYrwR1sIdshGY1rlKW1GP95e6sYtn7tB+ggsggE 0NiMQzDhv0ohkrfqB3udp4/xTHsktOux6zOM1sZbQJT70HtfRNVIlKa7mFQGPAlPf3Qx qffTjxB6H1kNx54mEUyPDNaT/Rhb91lI4MFBvVhSzhXqwoDpYm5h6Kqmjnl65lmi2Jlt 6MJpOVsj4RA55GpFd4WqRD9lUV/YAJ8PsrBjfDjuShSoJ2LthW29LKneOF3YuFJkIv+X HMmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784492962; x=1785097762; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=vyJ+vPMAWzCgV2xdQvJUUb61M5Tx5kuqql1lltVsoNs=; b=FJGBHfUPfOnDddz6kGtLfxDPg3m5Vbyi3a8tCwbWuN+lRLEQw54cAlldughkizQFCt gkAY8q5ArMLyOe3C7alH66K7+pYPyB97KZMO9VuC4Qynsitsfo7hlPrMQKKqCxIOV3LJ K6eiC092DIEZkanFb+1AOSR/KsfRvjwB1TZXgLYs/3GN2S5JM75y7LIjluJIyZXf5cme aj/jnbNLIr+uvGGAbtU3YCvcJZNJv1nqV19HiRdPfw1ypLfefop1/jU6daiYqkP69SJz 0UFPUOL3Zenvs2/Y5KY8kyFYgenu+ohFU9kSp62hwguU8ghGMLf1c7IftF8rN1AiFUmy yxnA== X-Forwarded-Encrypted: i=1; AHgh+RrE9RFY1jQQadGpXfWJ8e/0V0u8gBVJVPQoxPXSqE+6E4PuUrH2OFQ2PpyDgG6Du7OBJlaumF1RHk3UzJ8=@vger.kernel.org X-Gm-Message-State: AOJu0Yw2G02nNs7SxjaPP3Hus4GSyIYjkENI4i0P4fxaFtB3vUqhjDsq giPPMxe0ZXpbmbQCwQBc8IvJf6ggDI5AQ1ZCMZ1vWi35N3OrZdniqzk7Ua3Xl55byndN91JFRsG NXcui0hjx4XN4caVPooVaYDYrDnHv8IUVshwyAis79hbhzeVEMwQLyaayi1DDRQbB8bI= X-Gm-Gg: AfdE7clvNYEEjxYxmdFYkyrdZZEhqFrbc6B1JKhAA3DiwNjP2LL92O3/FezDT7xIzYk WKZveBZm93xD6k7TRowMXlpZn7usA9/OriV7+JPU32yJNjttNYf5hfPdi9VI8e890/+ncvlnBNC JcvBxuGI4fCSCX1xNsGke3p7lRz9J/o8q5SPx+shk5LGO1IONS/7TnY5QS306hTRFkXDBCOi5Om il506VoGUf2LgBgn7jaNpWONaHEvTJpqpRv+CmnZ/cgEaloMTwC1eXpkeBEfqKUdr5IelKiCxNf Qln5U1FqDGgz2n73sfXXp+jgQsk/sxplO01D2BYMSfN9NjDhhA3UW5ZNvMB5neMtVjDxCEjbH/3 LplZoYvLPAJRNHsRtCxRclsS7Yx2Fp2fFAKOo4xbiJBHjbZs= X-Received: by 2002:a17:90b:2685:b0:381:28e0:6248 with SMTP id 98e67ed59e1d1-38e4b3e368dmr9445026a91.1.1784492961863; Sun, 19 Jul 2026 13:29:21 -0700 (PDT) X-Received: by 2002:a17:90b:2685:b0:381:28e0:6248 with SMTP id 98e67ed59e1d1-38e4b3e368dmr9445016a91.1.1784492961430; Sun, 19 Jul 2026 13:29:21 -0700 (PDT) Received: from hu-zijuhu-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3142a20cfe3sm30974167eec.30.2026.07.19.13.29.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Jul 2026 13:29:20 -0700 (PDT) From: Zijun Hu Date: Sun, 19 Jul 2026 13:29:13 -0700 Subject: [PATCH] Bluetooth: hci_core: Explicitly kfree_skb() HCI_DRV_PKT and HCI_DIAG_PKT frames Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260719-fix_hci_rx_work-v1-1-2d7fdeed3640@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAJgzXWoC/x2MQQqAIBAAvyJ7TjCLsr4SIaFrLkHFChWEf086D szMCwmZMMEoXmC8KNGxF6grAS4u+4qSfGHQSneqrwcZ6LHRkeXH3gdvMqjG+3bwBoOBUp2MRfm P05zzB5mtXWZhAAAA X-Change-ID: 20260719-fix_hci_rx_work-f03dd49d8ef8 To: Marcel Holtmann , Luiz Augusto von Dentz Cc: Zijun Hu , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu X-Mailer: b4 0.14.3 X-Authority-Analysis: v=2.4 cv=HpxG3UTS c=1 sm=1 tr=0 ts=6a5d33a2 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=EUspDBNiAAAA:8 a=BoZhy_moxsucmNqAxV8A:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-GUID: zctX2GpHAh7c0WKWgHkV_PXYJ8VACndn X-Proofpoint-ORIG-GUID: zctX2GpHAh7c0WKWgHkV_PXYJ8VACndn X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE5MDIyOCBTYWx0ZWRfXz6pbpKDW/Uwx fATLpW7cKPqbxBUKy1wBTmCuzPfF/2YVtIMiELp2PNZKSTMqXWcmiEkj5gxe9h5PMA9V/BaMZtO /L0rO30GN36gxHYB1wIiUXdXh6xqxPb52huUU+TKxGaYJ7ASkSrRIAn15NNnlby5CNIHQ4z4YOy XfLHWnE98xKEaA3mkRXNpLgjS3unTX5vYKEKl7+gXUaQkKixI3ynS7dFIbaCfhKfewXH0BEGmah UZjDlfa0jFZYdglWHTVHaA5XN7+J6y6XB1VqLdTh64rnL9Vm3lGettcReyPWYCqeFGkAw5slr+o ohjFiQyfTzCKwAbn/o1w0mbMOL+O9raYLWK2t7C0GdvlsGBWo2dVd9N1d48PAuLCONuIjiO+zyE sBRIJo98vlPnm18dM6UtkVWmiLynnv3bRAmhVDssG8WkCDGshASzjSr3rChdbUazrtEHeVN7dGj OJJhHnVA/46+5KO3lyA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE5MDIyOCBTYWx0ZWRfX9lq+WJeAtgs0 rtdh8QqKwIMz5i8NrmFFlGPakGdD7/8XBsxu7ePNrtD4y1y7+JCfNunYpyCvYPDq6GL/3CEoUFg eWdh9eZMkihJ1kgdB0tXfsvfuaRwetE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-19_07,2026-07-17_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 clxscore=1015 priorityscore=1501 adultscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607190228 In hci_rx_work(), HCI_DRV_PKT and HCI_DIAG_PKT rely on the default case to free them, and cause: - They get mixed in with unknown packet types (default case). - It is not clear which packet types the function is handling. Fix by giving both their own case that kfree_skb()s explicitly. Signed-off-by: Zijun Hu --- net/bluetooth/hci_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d1e78ae7728e..1e324c05af24 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -4057,6 +4057,14 @@ static void hci_rx_work(struct work_struct *work) hci_isodata_packet(hdev, skb); break; =20 + case HCI_DRV_PKT: + kfree_skb(skb); + break; + + case HCI_DIAG_PKT: + kfree_skb(skb); + break; + default: kfree_skb(skb); break; --- base-commit: bd8bee79e1fa8db2d587733f8b6fd9597b04d6e3 change-id: 20260719-fix_hci_rx_work-f03dd49d8ef8 Best regards, --=20 Zijun Hu