All of lore.kernel.org
 help / color / mirror / Atom feed
From: patchwork-bot+bluetooth@kernel.org
To: Ali Ahmet Memis <ali@iusegentoo.com>
Cc: linux-bluetooth@vger.kernel.org, luiz.dentz@gmail.com,
	neeraj.sanjaykale@nxp.com, amitkumar.karwar@nxp.com,
	marcel@holtmann.org, alex.zhou@nxp.com, song.xue_1@nxp.com,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3] Bluetooth: btnxpuart: Validate the FW dump header length
Date: Mon, 17 Aug 2026 19:46:04 +0000	[thread overview]
Message-ID: <178699596488.1691257.10669499183665262272.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20260814182849.940976-1-ali@iusegentoo.com>

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 14 Aug 2026 18:28:48 +0000 you wrote:
> nxp_process_fw_dump() pulls the ACL header off the frame and then reads
> seq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb->data,
> without checking that the ACL payload is long enough to contain it.
> 
> h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the
> number of payload bytes named in that header, so skb->len is 4 + dlen
> with dlen supplied by the controller and possibly smaller than the 8
> byte dump header, or zero. A short frame with connection handle 0xfff
> therefore reads both fields from beyond the received data.
> 
> [...]

Here is the summary with links:
  - [v3] Bluetooth: btnxpuart: Validate the FW dump header length
    https://git.kernel.org/bluetooth/bluetooth-next/c/1fcf216462ec

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



  parent reply	other threads:[~2026-08-17 19:46 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-14  8:12 [PATCH] Bluetooth: btnxpuart: Validate the FW dump header length Ali Ahmet Memis
2026-08-14  8:33 ` Neeraj Kale
2026-08-14  8:41 ` [PATCH v2] " Ali Ahmet Memis
2026-08-14  8:58   ` Neeraj Kale
2026-08-14  9:41   ` [v2] " bluez.test.bot
2026-08-14 14:08   ` [PATCH v2] " Luiz Augusto von Dentz
2026-08-14 18:28     ` [PATCH v3] " Ali Ahmet Memis
2026-08-14 19:23       ` [v3] " bluez.test.bot
2026-08-17 19:46       ` patchwork-bot+bluetooth [this message]
2026-08-17  6:23     ` [PATCH v2] " Neeraj Kale

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178699596488.1691257.10669499183665262272.git-patchwork-notify@kernel.org \
    --to=patchwork-bot+bluetooth@kernel.org \
    --cc=alex.zhou@nxp.com \
    --cc=ali@iusegentoo.com \
    --cc=amitkumar.karwar@nxp.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luiz.dentz@gmail.com \
    --cc=marcel@holtmann.org \
    --cc=neeraj.sanjaykale@nxp.com \
    --cc=song.xue_1@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.