[PATCH BlueZ v3 1/2] lib: add iso_data_* macros to hci.h

[PATCH BlueZ v3 1/2] lib: add iso_data_* macros to hci.h

[Pauli Virtanen]

Add macros for parsing ISO Data Packet header items.
---

Notes:
    v3:
    - no change
    v2:
    - no change

 lib/bluetooth/hci.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/bluetooth/hci.h b/lib/bluetooth/hci.h
index 732477ec4..2e4aa394e 100644
--- a/lib/bluetooth/hci.h
+++ b/lib/bluetooth/hci.h
@@ -2335,6 +2335,12 @@ typedef struct {
 #define iso_flags_ts(f)		((f >> 2) & 0x0001)
 #define iso_flags_pack(pb, ts)	((pb & 0x03) | ((ts & 0x01) << 2))
 
+/* ISO data length and flags pack/unpack */
+#define iso_data_len_pack(h, f)	((__u16) (((h) & 0x0fff) | \
+						  (((f) & 0x3) << 14)))
+#define iso_data_len(h)		((h) & 0x0fff)
+#define iso_data_flags(h)	((h) >> 14)
+
 #endif /* _NO_HCI_DEFS */
 
 /* HCI Socket options */
-- 
2.55.0

[PATCH BlueZ v3 2/2] monitor: fix parsing of ISO packet data header and slen check

[Pauli Virtanen]

Check PB flag to see whether timestamp and data headers are present.

Check bounds before accessing data. Bump handle_str length to fit
maximum.

Byteswap length values, and mask Packet_Status_Flag correctly.  Remove
SDU length check, as we are not tracking fragmentation.

Fixes: https://github.com/bluez/bluez/issues/2292
Assisted-by: GLM-5.2
---

Notes:
    v3:
    - show slen and sflags only if nonzero
    v2:
    - increase extra_str size to avoid old gcc version static analysis
      false positive

 monitor/packet.c | 69 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 46 insertions(+), 23 deletions(-)

diff --git a/monitor/packet.c b/monitor/packet.c
index e62ad4cfb..4420efffe 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -14540,20 +14540,23 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 				bool in, const void *data, uint16_t size)
 {
 	const struct bt_hci_iso_hdr *hdr = data;
-	const struct bt_hci_iso_data_start *start;
-	uint16_t handle = le16_to_cpu(hdr->handle);
-	uint8_t flags = acl_flags(handle);
+	uint16_t handle, dlen;
+	uint8_t flags, pb_flag;
 	char label[8];
-	char handle_str[56], extra_str[50], ts_str[16] = { 0 };
-	struct index_buf_pool *pool = &index_list[index].iso;
+	char handle_str[100], extra_str[70], ts_str[16] = { 0 };
+	char sn_str[16] = { 0 }, slen_str[32] = { 0 };
+	struct index_buf_pool *pool;
 	struct packet_conn_data *conn;
 	size_t ts_size = 0;
+	bool have_hdr;
 
 	if (index >= MAX_INDEX) {
 		print_field("Invalid index (%d).", index);
 		return;
 	}
 
+	pool = &index_list[index].iso;
+
 	index_list[index].frame++;
 
 	if (size < sizeof(*hdr))
@@ -14562,11 +14565,18 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 	data += sizeof(*hdr);
 	size -= sizeof(*hdr);
 
+	handle = le16_to_cpu(hdr->handle);
+	flags = acl_flags(handle);
+	pb_flag = iso_flags_pb(flags);
+	dlen = le16_to_cpu(hdr->dlen);
+
+	have_hdr = (pb_flag == 0x00 || pb_flag == 0x02);
+
 	/* Detect if timestamp field is preset */
 	if (iso_flags_ts(flags)) {
 		ts_size = sizeof(uint32_t);
 
-		if (size < ts_size)
+		if (size < ts_size || !have_hdr)
 			goto malformed;
 
 		snprintf(ts_str, sizeof(ts_str), " ts %u", get_le32(data));
@@ -14575,20 +14585,40 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 		size -= ts_size;
 	}
 
-	start = data;
+	if (have_hdr) {
+		const struct bt_hci_iso_data_start *start = data;
+		uint8_t sflags;
+		uint16_t slen;
+
+		if (size < sizeof(*start))
+			goto malformed;
+
+		sflags = iso_data_flags(le16_to_cpu(start->slen));
+		slen = iso_data_len(le16_to_cpu(start->slen));
+
+		if (slen)
+			snprintf(slen_str, sizeof(slen_str), " slen %u", slen);
+		if (sflags)
+			snprintf(slen_str + strlen(slen_str),
+					sizeof(slen_str) - strlen(slen_str),
+					" sflags %u", sflags);
+
+		snprintf(sn_str, sizeof(sn_str), " SN %u",
+							le16_to_cpu(start->sn));
+	}
+
 	conn = packet_get_conn_data(handle);
 
 	if (!in && pool->total)
-		sprintf(handle_str, "Handle %d [%u/%u] SN %u",
-			acl_handle(handle), ++pool->tx, pool->total, start->sn);
+		sprintf(handle_str, "Handle %d [%u/%u]%s",
+			acl_handle(handle), ++pool->tx, pool->total, sn_str);
 	else
-		sprintf(handle_str, "Handle %u SN %u", acl_handle(handle),
-			start->sn);
+		sprintf(handle_str, "Handle %u%s", acl_handle(handle), sn_str);
 
 	handle_str_append_addr(handle_str, conn);
 
-	sprintf(extra_str, "flags 0x%2.2x dlen %u slen %u%s", flags, hdr->dlen,
-							start->slen, ts_str);
+	sprintf(extra_str, "flags 0x%2.2x dlen %u%s%s", flags, dlen, slen_str,
+									ts_str);
 
 	if (conn)
 		sprintf(label, "%s", conn_type_str(conn->type));
@@ -14600,18 +14630,11 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 
 	if (!in)
 		packet_enqueue_tx(tv, acl_handle(handle),
-					index_list[index].frame, hdr->dlen);
+					index_list[index].frame, dlen);
 
-	if (size + ts_size != hdr->dlen) {
+	if (size + ts_size != dlen) {
 		print_text(COLOR_ERROR, "invalid packet size (%d != %d)",
-						size + (int)ts_size, hdr->dlen);
-		packet_hexdump(data, size);
-		return;
-	}
-
-	if (size != start->slen + 4) {
-		print_text(COLOR_ERROR, "invalid packet slen (%d+4 != %d)",
-							start->slen, size);
+						size + (int)ts_size, dlen);
 		packet_hexdump(data, size);
 		return;
 	}
-- 
2.55.0

RE: [BlueZ,v3,1/2] lib: add iso_data_* macros to hci.h

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2275 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1125775

---Test result---

Test Summary:
CheckPatch                    FAIL      0.97 seconds
GitLint                       PASS      0.66 seconds
BuildEll                      PASS      20.05 seconds
BluezMake                     PASS      498.38 seconds
MakeCheck                     PASS      1.05 seconds
MakeDistcheck                 PASS      151.33 seconds
CheckValgrind                 PASS      144.07 seconds
CheckSmatch                   WARNING   291.38 seconds
bluezmakeextell               PASS      93.78 seconds
IncrementalBuild              PASS      528.94 seconds
ScanBuild                     PASS      856.17 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v3,2/2] monitor: fix parsing of ISO packet data header and slen check
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#104: 
Assisted-by: GLM-5.2

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'GLM-5.2'
#104: 
Assisted-by: GLM-5.2

/github/workspace/src/patch/14680481.patch total: 1 errors, 1 warnings, 115 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14680481.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2002:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3924:52: warning: array of flexible structuresmonitor/bt.h:3912:40: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2299

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v3 1/2] lib: add iso_data_* macros to hci.h

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Sat, 11 Jul 2026 12:15:25 +0300 you wrote:
> Add macros for parsing ISO Data Packet header items.
> ---
> 
> Notes:
>     v3:
>     - no change
>     v2:
>     - no change
> 
> [...]

Here is the summary with links:
  - [BlueZ,v3,1/2] lib: add iso_data_* macros to hci.h
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bc49d63210f2
  - [BlueZ,v3,2/2] monitor: fix parsing of ISO packet data header and slen check
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=1309d5f9305d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html