[PATCH v2 0/2] Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[PATCH v2 0/2] Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[Zijun Hu]

This series simplifies ACL handle extraction in btnxpuart and fixes
an skb leak when devcoredump support is disabled, — all simple.

---
Changes in v2:
- Add a minor ACL handle-extraction simplification in btnxpuart.
- Fix the skb leak in btnxpuart when devcoredump support is disabled.
- Link to v1: https://patch.msgid.link/20260913-misc_fix-v1-0-558c1e4028b9@oss.qualcomm.com

---
Zijun Hu (2):
      Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()
      Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

 drivers/bluetooth/btnxpuart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
---
base-commit: 0186e4e1e5c26a21058a263cccd878fbf894677e
change-id: 20260913-misc_fix-6f6f518fe6b5

Best regards,
--  
Zijun Hu <zijun.hu@oss.qualcomm.com>

[PATCH v2 1/2] Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()

[Zijun Hu]

Simplify nxp_recv_acl_pkt() by using hci_acl_handle() instead of:

__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
... (handle & 0x0FFF) ...

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/btnxpuart.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index f2bbe6e462aa..69e897444112 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1400,20 +1400,18 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
 
 free_skb:
 	kfree_skb(skb);
 	return 0;
 }
 
 static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
-
 	/* FW dump chunks are ACL packets with conn handle 0xfff */
-	if ((handle & 0x0FFF) == 0xFFF)
+	if (hci_acl_handle(skb) == 0xFFF)
 		return nxp_process_fw_dump(hdev, skb);
 	else
 		return hci_recv_frame(hdev, skb);
 }
 
 static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 {
 	union nxp_set_bd_addr_payload pcmd;

-- 
2.34.1

RE: Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165096/

---Test result---

Test Summary:
CheckPatch                    PASS      0.97 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.58 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      22.43 seconds
CheckAllWarning               PASS      25.40 seconds
CheckSparse                   PASS      28.19 seconds
BuildKernel32                 PASS      22.29 seconds
CheckKernelLLVM               PASS      23.99 seconds
TestRunnerSetup               PASS      568.19 seconds
IncrementalBuild              PASS      24.19 seconds



https://github.com/bluez/bluetooth-next/pull/770

---
Regards,
Linux Bluetooth

[PATCH v2 1/2] Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()

[Neeraj Kale]

Hi Zijun,

Thank you for the patch. The fix looks good to me.

Reviewed-by: Neeraj Sanjay Kale neeraj.sanjaykale@nxp.com

Thanks,
Neeraj

> Simplify nxp_recv_acl_pkt() by using hci_acl_handle() instead of:
>
> __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
> ... (handle & 0x0FFF) ...
>
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index f2bbe6e462aa..69e897444112 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1400,20 +1400,18 @@ static int nxp_process_fw_dump(struct hci_dev
> *hdev, struct sk_buff *skb)
>
>  free_skb:
>         kfree_skb(skb);
>         return 0;
>  }
>
>  static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)  {
> -       __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
> -
>         /* FW dump chunks are ACL packets with conn handle 0xfff */
> -       if ((handle & 0x0FFF) == 0xFFF)
> +       if (hci_acl_handle(skb) == 0xFFF)
>                 return nxp_process_fw_dump(hdev, skb);
>         else
>                 return hci_recv_frame(hdev, skb);  }
>
>  static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)  {
>         union nxp_set_bd_addr_payload pcmd;
>
> --
> 2.34.1


NXP Confidential

[PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Zijun Hu]

When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
without freeing its skb argument. This leaks the cloned skb and also
prevents nxp_set_ind_reset() from being called to perform recovery.

Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
CONFIG_DEV_COREDUMP.

Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/btnxpuart.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index 69e897444112..a0b64fdcbcc1 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
 		err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
 		if (err < 0)
 			goto free_skb;
 
 		schedule_delayed_work(&hdev->dump.dump_timeout,
 				      msecs_to_jiffies(20000));
 	}
 
+#ifdef CONFIG_DEV_COREDUMP
 	err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
 	if (err < 0)
 		goto free_skb;
+#endif
 
 	if (buf_len == 0) {
 		bt_dev_warn(hdev, "==== FW dump complete ===");
 		hci_devcd_complete(hdev);
 		nxp_set_ind_reset(hdev, NULL);
 	}
 
 free_skb:

-- 
2.34.1

[PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Neeraj Kale]

Hi Zijun,

Thank you for the patch. The fix looks good to me.

Reviewed-by: Neeraj Sanjay Kale neeraj.sanjaykale@nxp.com

Thanks,
Neeraj

> When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -
> EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and
> also prevents nxp_set_ind_reset() from being called to perform recovery.
>
> Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
> CONFIG_DEV_COREDUMP.
>
> Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump
> feature")
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 69e897444112..a0b64fdcbcc1 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev
> *hdev, struct sk_buff *skb)
>                 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
>                 if (err < 0)
>                         goto free_skb;
>
>                 schedule_delayed_work(&hdev->dump.dump_timeout,
>                                       msecs_to_jiffies(20000));
>         }
>
> +#ifdef CONFIG_DEV_COREDUMP
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
> +#endif
>
>         if (buf_len == 0) {
>                 bt_dev_warn(hdev, "==== FW dump complete ===");
>                 hci_devcd_complete(hdev);
>                 nxp_set_ind_reset(hdev, NULL);
>         }
>
>  free_skb:
>
> --
> 2.34.1


NXP Confidential

Re: [PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Luiz Augusto von Dentz]

Hi Zijun,

On Tue, Sep 15, 2026 at 1:41 AM Zijun Hu <zijun.hu@oss.qualcomm.com> wrote:
>
> When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
> without freeing its skb argument. This leaks the cloned skb and also
> prevents nxp_set_ind_reset() from being called to perform recovery.
>
> Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
> CONFIG_DEV_COREDUMP.
>
> Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 69e897444112..a0b64fdcbcc1 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
>                 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
>                 if (err < 0)
>                         goto free_skb;
>
>                 schedule_delayed_work(&hdev->dump.dump_timeout,
>                                       msecs_to_jiffies(20000));
>         }
>
> +#ifdef CONFIG_DEV_COREDUMP
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
> +#endif

I guess IS_ENABLED is preferable here so the code is still compiled in
leaving it up to the compiler to remove it in case it is considered
dead code.

>
>         if (buf_len == 0) {
>                 bt_dev_warn(hdev, "==== FW dump complete ===");
>                 hci_devcd_complete(hdev);
>                 nxp_set_ind_reset(hdev, NULL);
>         }
>
>  free_skb:
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz

[PATCH v3 1/2] Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()

[Zijun Hu]

Simplify nxp_recv_acl_pkt() by using hci_acl_handle() instead of:

__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
... (handle & 0x0FFF) ...

Reviewed-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/btnxpuart.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index 25e7b41b349f..b975a00eb6f8 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1400,20 +1400,18 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
 
 free_skb:
 	kfree_skb(skb);
 	return 0;
 }
 
 static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
-
 	/* FW dump chunks are ACL packets with conn handle 0xfff */
-	if ((handle & 0x0FFF) == 0xFFF)
+	if (hci_acl_handle(skb) == 0xFFF)
 		return nxp_process_fw_dump(hdev, skb);
 	else
 		return hci_recv_frame(hdev, skb);
 }
 
 static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 {
 	union nxp_set_bd_addr_payload pcmd;

-- 
2.34.1

RE: Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1166013/

---Test result---

Test Summary:
CheckPatch                    PASS      1.08 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.50 seconds
SubjectPrefix                 PASS      0.56 seconds
BuildKernel                   PASS      26.24 seconds
CheckAllWarning               PASS      31.20 seconds
CheckSparse                   PASS      33.19 seconds
BuildKernel32                 PASS      26.67 seconds
CheckKernelLLVM               PASS      30.04 seconds
TestRunnerSetup               PASS      673.08 seconds
IncrementalBuild              PASS      26.61 seconds



https://github.com/bluez/bluetooth-next/pull/780

---
Regards,
Linux Bluetooth