From nobody Sat Jul 25 16:18:32 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E9103F39CE; Thu, 16 Jul 2026 08:48:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191694; cv=none; b=eQBeuoj5mM0b8+aZD9Lvh3lJb/2TJB3NWIcLKXclVGH2FNmztGp+1Tj4IlFshjA5fdp8k59bVW6KkPdO0EIEECjYeJcvLuSoSf6mFdJFix7xqjLvb+aOSKpm5A9c+oyOYjvGp0jaM5c1NPwRCUG9/3JrOwMrsUOAf6DI5x96rxs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191694; c=relaxed/simple; bh=MVdmPcaWyVy3JP2kCitS0f6oP3GTIXBvQwQL/DaAA8k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VeqTSKOWMfZarsIILBxUhz75q5cpYh7WB6wG0Il7i4DV19/pwDOJ219T0I8LmCqTxxe8knNR+Fpma5M2y0ff/w3KIT1AWny8jXvI6mS6Q+rRi1McDq6AEqT2+YZPI92NmTjQN7/21WTZw8C+dJu9lH40LTsM8/ufHIRRzL+cvek= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 0ba10b5480f311f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_EXISTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:1420eca0-e2f5-45c0-9419-085d5f24bbe9,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:1420eca0-e2f5-45c0-9419-085d5f24bbe9,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:e828882c9c8458322efd681cfb785677,BulkI D:260716164759OD3OA5D0,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,Bulk:nil, QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 ,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 0ba10b5480f311f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1958976310; Thu, 16 Jul 2026 16:47:58 +0800 From: Li Qiang To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, Li Qiang Subject: [PATCH 1/5] Bluetooth: bfusb: validate received block boundaries Date: Thu, 16 Jul 2026 16:47:28 +0800 Message-ID: <1f79f2f12306c15d6f686348bb79d8e6839968d2.1784191283.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The USB receive path trusts the block header to contain the required number of bytes and passes it to the reassembly routine. The routine also trusts a malformed HCI packet type and can append more data than the skb allocated from the advertised packet length. A malformed USB transfer can therefore cause out-of-bounds reads or an skb tail overwrite. Validate block header availability, declared block size, packet type, and reassembly tailroom. Drop the partial frame on an invalid block. Signed-off-by: Li Qiang --- drivers/bluetooth/bfusb.c | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c index 8df310983bf6..d31d797639b5 100644 --- a/drivers/bluetooth/bfusb.c +++ b/drivers/bluetooth/bfusb.c @@ -301,6 +301,11 @@ static inline int bfusb_recv_block(struct bfusb_data *= data, int hdr, unsigned ch return -EILSEQ; } break; + + default: + bt_dev_err(data->hdev, "unknown packet type 0x%02x", + pkt_type); + return -EILSEQ; } =20 skb =3D bt_skb_alloc(pkt_len, GFP_ATOMIC); @@ -319,6 +324,13 @@ static inline int bfusb_recv_block(struct bfusb_data *= data, int hdr, unsigned ch } } =20 + if (len > skb_tailroom(data->reassembly)) { + bt_dev_err(data->hdev, "block exceeds packet length"); + kfree_skb(data->reassembly); + data->reassembly =3D NULL; + return -EILSEQ; + } + if (len > 0) skb_put_data(data->reassembly, buf, len); =20 @@ -353,6 +365,13 @@ static void bfusb_rx_complete(struct urb *urb) skb_put(skb, count); =20 while (count) { + if (count < 2) { + bt_dev_err(data->hdev, "short block header"); + kfree_skb(data->reassembly); + data->reassembly =3D NULL; + break; + } + hdr =3D buf[0] | (buf[1] << 8); =20 if (hdr & 0x4000) { @@ -360,16 +379,28 @@ static void bfusb_rx_complete(struct urb *urb) count -=3D 2; buf +=3D 2; } else { + if (count < 3) { + bt_dev_err(data->hdev, "short block header"); + kfree_skb(data->reassembly); + data->reassembly =3D NULL; + break; + } + len =3D (buf[2] =3D=3D 0) ? 256 : buf[2]; count -=3D 3; buf +=3D 3; } =20 - if (count < len) + if (count < len) { bt_dev_err(data->hdev, "block extends over URB buffer ranges"); + kfree_skb(data->reassembly); + data->reassembly =3D NULL; + break; + } =20 - if ((hdr & 0xe1) =3D=3D 0xc1) - bfusb_recv_block(data, hdr, buf, len); + if ((hdr & 0xe1) =3D=3D 0xc1 && + bfusb_recv_block(data, hdr, buf, len) < 0) + data->hdev->stat.err_rx++; =20 count -=3D len; buf +=3D len; --=20 2.43.0 From nobody Sat Jul 25 16:18:32 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 448643B961F; Thu, 16 Jul 2026 08:48:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191691; cv=none; b=S9Wo0Y9/ahyqOqJJ/T+Dign304SjczFjDgC/KZS6A4tVlx6NH1D66mbCDzM7PKZoq4IvtRN8lmz3iEJY+XGLjlv26Qrv2dA/bjSXmSF7r0dYCAtWAW4wmZiSA/IOdiuY77ANmctcB+S1pM0bTa45W8sdltbyinR89FeeJyw5SRk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191691; c=relaxed/simple; bh=LmCayJ9+Wjm99zGyb7HqHOrgDuZXSyR/2h9nQ4uAWGA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GI1YwPD5aKy/TLgOWYNHj+HDs42m8XajqAEHaACVvZfieP8iZQDTrWX8+sAJopn2ZDhKAgkKiWhxFj6PdNlin008SG6+CIHPaOf3hiBrtwmO3a/IZh0iN1hHL4IFdiC9XRkyVQcJlWI633uPAfhRaKd7zhNK8RlEXCLYRqL4ctY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 0bd686c680f311f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_EXISTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:58c440c3-e3e1-470b-a1f6-1382b5e3ca5d,IP:15, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:58c440c3-e3e1-470b-a1f6-1382b5e3ca5d,IP:15,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION:r elease,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:f02665f253f8d726a52f493f920aa00c,BulkI D:260716164759C48U6KQP,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk:nil ,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE: 0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 0bd686c680f311f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1233171991; Thu, 16 Jul 2026 16:47:58 +0800 From: Li Qiang To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, Li Qiang Subject: [PATCH 2/5] Bluetooth: btmrvl: validate event packet lengths Date: Thu, 16 Jul 2026 16:47:29 +0800 Message-ID: <628bdb80b4ae352606d6cfb175180c980a8c362a.1784191283.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Marvell event handlers access the HCI event header, command complete payload, and driver-specific event header before validating that the received skb contains them. A truncated event can consequently cause an out-of-bounds read. Validate each header and the command-complete payload length before dereferencing the corresponding fields. Signed-off-by: Li Qiang --- drivers/bluetooth/btmrvl_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_mai= n.c index d6f0ad0b4b6e..aaf1614ccfd7 100644 --- a/drivers/bluetooth/btmrvl_main.c +++ b/drivers/bluetooth/btmrvl_main.c @@ -43,10 +43,17 @@ bool btmrvl_check_evtpkt(struct btmrvl_private *priv, s= truct sk_buff *skb) { struct hci_event_hdr *hdr =3D (void *) skb->data; =20 + if (skb->len < sizeof(*hdr)) + return true; + if (hdr->evt =3D=3D HCI_EV_CMD_COMPLETE) { struct hci_ev_cmd_complete *ec; u16 opcode; =20 + if (hdr->plen < sizeof(*ec) || + skb->len < HCI_EVENT_HDR_SIZE + sizeof(*ec)) + return true; + ec =3D (void *) (skb->data + HCI_EVENT_HDR_SIZE); opcode =3D __le16_to_cpu(ec->opcode); =20 @@ -74,6 +81,9 @@ int btmrvl_process_event(struct btmrvl_private *priv, str= uct sk_buff *skb) struct btmrvl_event *event; int ret =3D 0; =20 + if (skb->len < sizeof(*event)) + return -EINVAL; + event =3D (struct btmrvl_event *) skb->data; if (event->ec !=3D 0xff) { BT_DBG("Not Marvell Event=3D%x", event->ec); --=20 2.43.0 From nobody Sat Jul 25 16:18:32 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF5FC2EA154; Thu, 16 Jul 2026 08:48:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191694; cv=none; b=NmsCOIAkfFK0XJBJExJMRX4b30sVW/cJfKsdu/mT+wylhsyBaZwtolc2QGxrYQwfGhJIzTP5kjN1cgpPIze+Sal6fNJ1WKUJodNZGVfaZuauQPH7kgAImDegsFRNV9+SH1X7k3cmVwLjDnDwo0E5EPZk2G+SV26mKqVenDVGA04= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191694; c=relaxed/simple; bh=HKbEkQPC5cuSILEFB8UwEv+a0ZbyxXh6bMc1HjO+9Kg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aPJk43oh0wJ49OpRjoMr9ezsvnikb6s79kqPUoU5pgqPdm/Spc1tZ+Bc89dBQ45EY39kZrp7Iv+LSf/YtuwCjnMTBl1A8J6DBnQ+xh7ASUjUtYXFXRr8MP7I06eR03IHsvqHf0LqNUSvr7sblXG34gJFxPa7iDuvJYVOFmFu0HU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 0c0b6af880f311f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_EXISTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:9b7ceab5-155a-4819-8cfa-2cdd3938675f,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:9b7ceab5-155a-4819-8cfa-2cdd3938675f,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:6491480b888ce79960a31317acecbcf9,BulkI D:260716164802NMIKEDLQ,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,Bulk:nil, QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 ,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 0c0b6af880f311f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1768790698; Thu, 16 Jul 2026 16:47:59 +0800 From: Li Qiang To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, Li Qiang Subject: [PATCH 3/5] Bluetooth: hci_bcsp: validate received packet lengths Date: Thu, 16 Jul 2026 16:47:30 +0800 Message-ID: <6fb9de3e499424f7980a158798ea02b040b73b8f.1784191283.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The BCSP transmit path reads an HCI command header when an extension packet has only been tested for a nonzero length. Its LE configuration packet handler also indexes bytes through offset seven without a length check. Validate the complete command and LE configuration packet headers before accessing their fields. Signed-off-by: Li Qiang --- drivers/bluetooth/hci_bcsp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c index db56eead27ce..0323db21c428 100644 --- a/drivers/bluetooth/hci_bcsp.c +++ b/drivers/bluetooth/hci_bcsp.c @@ -194,7 +194,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_str= uct *bcsp, u8 *data, return NULL; } =20 - if (hciextn && chan =3D=3D 5) { + if (hciextn && chan =3D=3D 5 && len > HCI_COMMAND_HDR_SIZE) { __le16 opcode =3D ((struct hci_command_hdr *)data)->opcode; =20 /* Vendor specific commands */ @@ -402,6 +402,9 @@ static void bcsp_handle_le_pkt(struct hci_uart *hu) u8 sync_pkt[4] =3D { 0xda, 0xdc, 0xed, 0xed }; =20 /* spot "conf" pkts and reply with a "conf rsp" pkt */ + if (bcsp->rx_skb->len < 8) + return; + if (bcsp->rx_skb->data[1] >> 4 =3D=3D 4 && bcsp->rx_skb->data[2] =3D=3D 0= && !memcmp(&bcsp->rx_skb->data[4], conf_pkt, 4)) { struct sk_buff *nskb =3D alloc_skb(4, GFP_ATOMIC); --=20 2.43.0 From nobody Sat Jul 25 16:18:32 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3E043D648F; Thu, 16 Jul 2026 08:48:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191693; cv=none; b=HsUSLxWYw8fHap2q6IcyQHgqlKfSftduL3efbol5RGhX7izWmxXPgHhq3+anFtQKTltZITCCUimw4n9vSGfwbCUuAarJDIXj87ZQC6gIlDQMwR5cUcEpbAxsa6uvIYCveMU/WleFFI8g8XWMyvrRXTtDCoJ0G67ksk9xPeWdcBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191693; c=relaxed/simple; bh=Mmb11qGuNuQ9Ukkjol4ysz52hCWhPKx8Ft4uCnzggGU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YRhT7MyO3DUSvSfhrNTN5f0pAmzYzDRu7esc+yk/JUD/cegI+GdBb/lK5o+7ttYkriOILOYxudzy6+8xRfkFuf8y5km5x/B87O1o2gYQlddDxdIjlIP9MRItvInHY4NyaGqCWOm3hU9czpEV84s8x5SRzrZj2/I1flDmq37/96U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 0c3e3b3680f311f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_EXISTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:c9c50dc8-5415-477a-83c7-be4a1cfcaa67,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:c9c50dc8-5415-477a-83c7-be4a1cfcaa67,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:434d1b4dc89c9ee2f4d28a6a73807593,BulkI D:2607161648028MSLF5DN,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,Bulk:nil, QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 ,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 0c3e3b3680f311f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1545707886; Thu, 16 Jul 2026 16:47:59 +0800 From: Li Qiang To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, Li Qiang Subject: [PATCH 4/5] Bluetooth: hci_ldisc: reject invalid tty write lengths Date: Thu, 16 Jul 2026 16:47:31 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The HCI UART write worker assumes that a tty write callback returns a value in the range from zero through the skb length. A negative value or a value larger than the skb length is passed to accounting and skb_pull, which can corrupt skb state. Treat either return value as a transmit error and discard the skb. Signed-off-by: Li Qiang --- drivers/bluetooth/hci_ldisc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 47f4902b40b4..668c4f84d7f2 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -163,6 +163,12 @@ static void hci_uart_write_work(struct work_struct *wo= rk) =20 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); len =3D tty->ops->write(tty, skb->data, skb->len); + if (len < 0 || len > skb->len) { + hdev->stat.err_tx++; + kfree_skb(skb); + continue; + } + hdev->stat.byte_tx +=3D len; =20 skb_pull(skb, len); --=20 2.43.0 From nobody Sat Jul 25 16:18:32 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 898B13F4825; Thu, 16 Jul 2026 08:48:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191696; cv=none; b=OLhZOEqDiIlDPmQRgYH4HGatWGz8tYZ6Qeu1Uzl12WtOYzVEf3Bb+k8/MFzhP8uZz5ivK8rlNdrIqA6MXmxTB7liiXd5xWvrn516AqpVCwq+8EJ4NkZTg+C0LgnYWzyhjgiSziLVVzeFmp9hPhabDDUoI7DtYtGxUlCAopAf2oc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784191696; c=relaxed/simple; bh=WUy/DueWHXdfslzF2Ib8dbFUG7k3Yte9eQjky9JmwPU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I9SVmjDcrsx6gP9kT0AYL6hBzXm6O1PsHpDIMq10LXfjFL2j6E8D4bU3AYCtmk5qxPS+wTzf+7BMCCIkSGJlgRjrkaTBFc18lTEihhean2fN3w+uzLdh5wexmcpUvPBQ2DKbWDrAxotwKKe0VzTX6yDNjNaGSdoRiSgG1cMxM6I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 0c7314aa80f311f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_EXISTED, SN_EXISTED, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:909b81ca-e4f2-4f5e-9d47-a5b9421acf68,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:909b81ca-e4f2-4f5e-9d47-a5b9421acf68,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:98c56fec77a48d406ad30e5678ceb5d1,BulkI D:260716164802BG83684B,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,Bulk:nil, QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 ,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 0c7314aa80f311f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 95112118; Thu, 16 Jul 2026 16:47:59 +0800 From: Li Qiang To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, Li Qiang Subject: [PATCH 5/5] Bluetooth: hci_qca: validate controller memdump frames Date: Thu, 16 Jul 2026 16:47:32 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The QCA controller memdump worker reads frame and dump-size headers before validating the received skb length. The event classifier likewise accesses its fixed header without ensuring that all accessed bytes are present. Malformed controller data can therefore cause out-of-bounds reads. Validate every header and the initial dump size before changing the dump state. Reset the local dump state when discarding an unstarted collection. Use subtraction-based capacity checks to prevent overflow while accounting for received and synthesized dump data. Signed-off-by: Li Qiang --- drivers/bluetooth/hci_qca.c | 58 ++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 17 deletions(-) diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c index b2d1ee3a3d11..b5d4b8e0e376 100644 --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -1057,6 +1057,34 @@ static void qca_controller_memdump(struct work_struc= t *work) return; } =20 + if (skb->len < sizeof(*cmd_hdr)) { + bt_dev_err(hu->hdev, "Rx short memdump header"); + kfree_skb(skb); + mutex_unlock(&qca->hci_memdump_lock); + continue; + } + + cmd_hdr =3D (void *) skb->data; + seq_no =3D __le16_to_cpu(cmd_hdr->seq_no); + skb_pull(skb, sizeof(struct qca_memdump_event_hdr)); + + if (!seq_no) { + if (skb->len < sizeof(*dump)) { + bt_dev_err(hu->hdev, "Rx short memdump size"); + kfree_skb(skb); + mutex_unlock(&qca->hci_memdump_lock); + continue; + } + + dump =3D (void *)skb->data; + if (!__le32_to_cpu(dump->dump_size)) { + bt_dev_err(hu->hdev, "Rx invalid memdump size"); + kfree_skb(skb); + mutex_unlock(&qca->hci_memdump_lock); + continue; + } + } + if (!qca_memdump) { qca_memdump =3D kzalloc_obj(*qca_memdump, GFP_ATOMIC); if (!qca_memdump) { @@ -1068,9 +1096,6 @@ static void qca_controller_memdump(struct work_struct= *work) } =20 qca->memdump_state =3D QCA_MEMDUMP_COLLECTING; - cmd_hdr =3D (void *) skb->data; - seq_no =3D __le16_to_cpu(cmd_hdr->seq_no); - skb_pull(skb, sizeof(struct qca_memdump_event_hdr)); =20 if (!seq_no) { =20 @@ -1082,15 +1107,7 @@ static void qca_controller_memdump(struct work_struc= t *work) */ set_bit(QCA_IBS_DISABLED, &qca->flags); set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags); - dump =3D (void *) skb->data; qca_memdump->ram_dump_size =3D __le32_to_cpu(dump->dump_size); - if (!(qca_memdump->ram_dump_size)) { - bt_dev_err(hu->hdev, "Rx invalid memdump size"); - kfree(qca_memdump); - kfree_skb(skb); - mutex_unlock(&qca->hci_memdump_lock); - return; - } =20 queue_delayed_work(qca->workqueue, &qca->ctrl_memdump_timeout, @@ -1123,6 +1140,8 @@ static void qca_controller_memdump(struct work_struct= *work) if (!test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) { bt_dev_err(hu->hdev, "QCA: Discarding other packets"); kfree(qca_memdump); + qca->qca_memdump =3D NULL; + qca->memdump_state =3D QCA_MEMDUMP_IDLE; kfree_skb(skb); mutex_unlock(&qca->hci_memdump_lock); return; @@ -1140,9 +1159,11 @@ static void qca_controller_memdump(struct work_struc= t *work) seq_no !=3D QCA_LAST_SEQUENCE_NUM) { bt_dev_err(hu->hdev, "QCA controller missed packet:%d", qca_memdump->current_seq_no); - rx_size =3D qca_memdump->received_dump; - rx_size +=3D QCA_DUMP_PACKET_SIZE; - if (rx_size > qca_memdump->ram_dump_size) { + if (qca_memdump->received_dump > + qca_memdump->ram_dump_size || + QCA_DUMP_PACKET_SIZE > + qca_memdump->ram_dump_size - + qca_memdump->received_dump) { bt_dev_err(hu->hdev, "QCA memdump received %d, no space for missed packet", qca_memdump->received_dump); @@ -1154,8 +1175,10 @@ static void qca_controller_memdump(struct work_struc= t *work) qca_memdump->current_seq_no++; } =20 - rx_size =3D qca_memdump->received_dump + skb->len; - if (rx_size <=3D qca_memdump->ram_dump_size) { + if (qca_memdump->received_dump <=3D qca_memdump->ram_dump_size && + skb->len <=3D qca_memdump->ram_dump_size - + qca_memdump->received_dump) { + rx_size =3D qca_memdump->received_dump + skb->len; if ((seq_no !=3D QCA_LAST_SEQUENCE_NUM) && (seq_no !=3D qca_memdump->current_seq_no)) { bt_dev_err(hu->hdev, @@ -1235,7 +1258,8 @@ static int qca_recv_event(struct hci_dev *hdev, struc= t sk_buff *skb) * received we store dump into a file before closing hci. This * dump will help in triaging the issues. */ - if ((skb->data[0] =3D=3D HCI_VENDOR_PKT) && + if (skb->len >=3D offsetof(struct qca_memdump_event_hdr, seq_no) && + (skb->data[0] =3D=3D HCI_VENDOR_PKT) && (get_unaligned_be16(skb->data + 2) =3D=3D QCA_SSR_DUMP_HANDLE)) return qca_controller_memdump_event(hdev, skb); =20 --=20 2.43.0