[PATCH BlueZ v2 1/2] lib: add iso_data_* macros to hci.h

[PATCH BlueZ v2 1/2] lib: add iso_data_* macros to hci.h

[Pauli Virtanen]

Add macros for parsing ISO Data Packet header items.
---

Notes:
    v2:
    - no change

 lib/bluetooth/hci.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/bluetooth/hci.h b/lib/bluetooth/hci.h
index 732477ec4..2e4aa394e 100644
--- a/lib/bluetooth/hci.h
+++ b/lib/bluetooth/hci.h
@@ -2335,6 +2335,12 @@ typedef struct {
 #define iso_flags_ts(f)		((f >> 2) & 0x0001)
 #define iso_flags_pack(pb, ts)	((pb & 0x03) | ((ts & 0x01) << 2))
 
+/* ISO data length and flags pack/unpack */
+#define iso_data_len_pack(h, f)	((__u16) (((h) & 0x0fff) | \
+						  (((f) & 0x3) << 14)))
+#define iso_data_len(h)		((h) & 0x0fff)
+#define iso_data_flags(h)	((h) >> 14)
+
 #endif /* _NO_HCI_DEFS */
 
 /* HCI Socket options */
-- 
2.55.0

[PATCH BlueZ v2 2/2] monitor: fix parsing of ISO packet data header and slen check

[Pauli Virtanen]

Check PB flag to see whether timestamp and data headers are present.

Check bounds before accessing data. Bump handle_str length to fit
maximum.

Byteswap length values, and mask Packet_Status_Flag correctly.  Remove
SDU length check, as we are not tracking fragmentation.

Fixes: https://github.com/bluez/bluez/issues/2292
Assisted-by: GLM-5.2
---

Notes:
    v2:
    - increase extra_str size to avoid old gcc version static analysis
      false positive

 monitor/packet.c | 60 +++++++++++++++++++++++++++++-------------------
 1 file changed, 37 insertions(+), 23 deletions(-)

diff --git a/monitor/packet.c b/monitor/packet.c
index e62ad4cfb..a478cf93a 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -14540,20 +14540,23 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 				bool in, const void *data, uint16_t size)
 {
 	const struct bt_hci_iso_hdr *hdr = data;
-	const struct bt_hci_iso_data_start *start;
-	uint16_t handle = le16_to_cpu(hdr->handle);
-	uint8_t flags = acl_flags(handle);
+	uint16_t handle, dlen;
+	uint8_t flags, pb_flag;
 	char label[8];
-	char handle_str[56], extra_str[50], ts_str[16] = { 0 };
-	struct index_buf_pool *pool = &index_list[index].iso;
+	char handle_str[100], extra_str[70], ts_str[16] = { 0 };
+	char sn_str[16] = { 0 }, slen_str[32] = { 0 };
+	struct index_buf_pool *pool;
 	struct packet_conn_data *conn;
 	size_t ts_size = 0;
+	bool have_hdr;
 
 	if (index >= MAX_INDEX) {
 		print_field("Invalid index (%d).", index);
 		return;
 	}
 
+	pool = &index_list[index].iso;
+
 	index_list[index].frame++;
 
 	if (size < sizeof(*hdr))
@@ -14562,11 +14565,18 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 	data += sizeof(*hdr);
 	size -= sizeof(*hdr);
 
+	handle = le16_to_cpu(hdr->handle);
+	flags = acl_flags(handle);
+	pb_flag = iso_flags_pb(flags);
+	dlen = le16_to_cpu(hdr->dlen);
+
+	have_hdr = (pb_flag == 0x00 || pb_flag == 0x02);
+
 	/* Detect if timestamp field is preset */
 	if (iso_flags_ts(flags)) {
 		ts_size = sizeof(uint32_t);
 
-		if (size < ts_size)
+		if (size < ts_size || !have_hdr)
 			goto malformed;
 
 		snprintf(ts_str, sizeof(ts_str), " ts %u", get_le32(data));
@@ -14575,20 +14585,31 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 		size -= ts_size;
 	}
 
-	start = data;
+	if (have_hdr) {
+		const struct bt_hci_iso_data_start *start = data;
+
+		if (size < sizeof(*start))
+			goto malformed;
+
+		snprintf(sn_str, sizeof(sn_str), " SN %u",
+							le16_to_cpu(start->sn));
+		snprintf(slen_str, sizeof(slen_str), " slen %u sflags %u",
+				iso_data_len(le16_to_cpu(start->slen)),
+				iso_data_flags(le16_to_cpu(start->slen)));
+	}
+
 	conn = packet_get_conn_data(handle);
 
 	if (!in && pool->total)
-		sprintf(handle_str, "Handle %d [%u/%u] SN %u",
-			acl_handle(handle), ++pool->tx, pool->total, start->sn);
+		sprintf(handle_str, "Handle %d [%u/%u]%s",
+			acl_handle(handle), ++pool->tx, pool->total, sn_str);
 	else
-		sprintf(handle_str, "Handle %u SN %u", acl_handle(handle),
-			start->sn);
+		sprintf(handle_str, "Handle %u%s", acl_handle(handle), sn_str);
 
 	handle_str_append_addr(handle_str, conn);
 
-	sprintf(extra_str, "flags 0x%2.2x dlen %u slen %u%s", flags, hdr->dlen,
-							start->slen, ts_str);
+	sprintf(extra_str, "flags 0x%2.2x dlen %u%s%s", flags, dlen, slen_str,
+									ts_str);
 
 	if (conn)
 		sprintf(label, "%s", conn_type_str(conn->type));
@@ -14600,18 +14621,11 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 
 	if (!in)
 		packet_enqueue_tx(tv, acl_handle(handle),
-					index_list[index].frame, hdr->dlen);
+					index_list[index].frame, dlen);
 
-	if (size + ts_size != hdr->dlen) {
+	if (size + ts_size != dlen) {
 		print_text(COLOR_ERROR, "invalid packet size (%d != %d)",
-						size + (int)ts_size, hdr->dlen);
-		packet_hexdump(data, size);
-		return;
-	}
-
-	if (size != start->slen + 4) {
-		print_text(COLOR_ERROR, "invalid packet slen (%d+4 != %d)",
-							start->slen, size);
+						size + (int)ts_size, dlen);
 		packet_hexdump(data, size);
 		return;
 	}
-- 
2.55.0

Re: [PATCH BlueZ v2 2/2] monitor: fix parsing of ISO packet data header and slen check

[Luiz Augusto von Dentz]

Hi Pauli,

On Fri, Jul 10, 2026 at 2:16 PM Pauli Virtanen <pav@iki.fi> wrote:
>
> Check PB flag to see whether timestamp and data headers are present.
>
> Check bounds before accessing data. Bump handle_str length to fit
> maximum.
>
> Byteswap length values, and mask Packet_Status_Flag correctly.  Remove
> SDU length check, as we are not tracking fragmentation.
>
> Fixes: https://github.com/bluez/bluez/issues/2292
> Assisted-by: GLM-5.2
> ---
>
> Notes:
>     v2:
>     - increase extra_str size to avoid old gcc version static analysis
>       false positive
>
>  monitor/packet.c | 60 +++++++++++++++++++++++++++++-------------------
>  1 file changed, 37 insertions(+), 23 deletions(-)
>
> diff --git a/monitor/packet.c b/monitor/packet.c
> index e62ad4cfb..a478cf93a 100644
> --- a/monitor/packet.c
> +++ b/monitor/packet.c
> @@ -14540,20 +14540,23 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
>                                 bool in, const void *data, uint16_t size)
>  {
>         const struct bt_hci_iso_hdr *hdr = data;
> -       const struct bt_hci_iso_data_start *start;
> -       uint16_t handle = le16_to_cpu(hdr->handle);
> -       uint8_t flags = acl_flags(handle);
> +       uint16_t handle, dlen;
> +       uint8_t flags, pb_flag;
>         char label[8];
> -       char handle_str[56], extra_str[50], ts_str[16] = { 0 };
> -       struct index_buf_pool *pool = &index_list[index].iso;
> +       char handle_str[100], extra_str[70], ts_str[16] = { 0 };
> +       char sn_str[16] = { 0 }, slen_str[32] = { 0 };
> +       struct index_buf_pool *pool;
>         struct packet_conn_data *conn;
>         size_t ts_size = 0;
> +       bool have_hdr;
>
>         if (index >= MAX_INDEX) {
>                 print_field("Invalid index (%d).", index);
>                 return;
>         }
>
> +       pool = &index_list[index].iso;
> +
>         index_list[index].frame++;
>
>         if (size < sizeof(*hdr))
> @@ -14562,11 +14565,18 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
>         data += sizeof(*hdr);
>         size -= sizeof(*hdr);
>
> +       handle = le16_to_cpu(hdr->handle);
> +       flags = acl_flags(handle);
> +       pb_flag = iso_flags_pb(flags);
> +       dlen = le16_to_cpu(hdr->dlen);
> +
> +       have_hdr = (pb_flag == 0x00 || pb_flag == 0x02);
> +
>         /* Detect if timestamp field is preset */
>         if (iso_flags_ts(flags)) {
>                 ts_size = sizeof(uint32_t);
>
> -               if (size < ts_size)
> +               if (size < ts_size || !have_hdr)
>                         goto malformed;
>
>                 snprintf(ts_str, sizeof(ts_str), " ts %u", get_le32(data));
> @@ -14575,20 +14585,31 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
>                 size -= ts_size;
>         }
>
> -       start = data;
> +       if (have_hdr) {
> +               const struct bt_hci_iso_data_start *start = data;
> +
> +               if (size < sizeof(*start))
> +                       goto malformed;
> +
> +               snprintf(sn_str, sizeof(sn_str), " SN %u",
> +                                                       le16_to_cpu(start->sn));
> +               snprintf(slen_str, sizeof(slen_str), " slen %u sflags %u",
> +                               iso_data_len(le16_to_cpu(start->slen)),
> +                               iso_data_flags(le16_to_cpu(start->slen)));

I wonder if we could just skip displaying `slen` when it is 0 so we
only decode `sflags` for incomplete packets (0xxx).

> +       }
> +
>         conn = packet_get_conn_data(handle);
>
>         if (!in && pool->total)
> -               sprintf(handle_str, "Handle %d [%u/%u] SN %u",
> -                       acl_handle(handle), ++pool->tx, pool->total, start->sn);
> +               sprintf(handle_str, "Handle %d [%u/%u]%s",
> +                       acl_handle(handle), ++pool->tx, pool->total, sn_str);
>         else
> -               sprintf(handle_str, "Handle %u SN %u", acl_handle(handle),
> -                       start->sn);
> +               sprintf(handle_str, "Handle %u%s", acl_handle(handle), sn_str);
>
>         handle_str_append_addr(handle_str, conn);
>
> -       sprintf(extra_str, "flags 0x%2.2x dlen %u slen %u%s", flags, hdr->dlen,
> -                                                       start->slen, ts_str);
> +       sprintf(extra_str, "flags 0x%2.2x dlen %u%s%s", flags, dlen, slen_str,
> +                                                                       ts_str);
>
>         if (conn)
>                 sprintf(label, "%s", conn_type_str(conn->type));
> @@ -14600,18 +14621,11 @@ void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
>
>         if (!in)
>                 packet_enqueue_tx(tv, acl_handle(handle),
> -                                       index_list[index].frame, hdr->dlen);
> +                                       index_list[index].frame, dlen);
>
> -       if (size + ts_size != hdr->dlen) {
> +       if (size + ts_size != dlen) {
>                 print_text(COLOR_ERROR, "invalid packet size (%d != %d)",
> -                                               size + (int)ts_size, hdr->dlen);
> -               packet_hexdump(data, size);
> -               return;
> -       }
> -
> -       if (size != start->slen + 4) {
> -               print_text(COLOR_ERROR, "invalid packet slen (%d+4 != %d)",
> -                                                       start->slen, size);
> +                                               size + (int)ts_size, dlen);
>                 packet_hexdump(data, size);
>                 return;
>         }
> --
> 2.55.0
>
>


-- 
Luiz Augusto von Dentz

RE: [BlueZ,v2,1/2] lib: add iso_data_* macros to hci.h

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2275 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1125549

---Test result---

Test Summary:
CheckPatch                    FAIL      0.98 seconds
GitLint                       PASS      0.76 seconds
BuildEll                      PASS      21.12 seconds
BluezMake                     PASS      552.39 seconds
MakeCheck                     PASS      1.03 seconds
MakeDistcheck                 PASS      163.72 seconds
CheckValgrind                 PASS      158.74 seconds
CheckSmatch                   WARNING   317.83 seconds
bluezmakeextell               PASS      104.59 seconds
IncrementalBuild              PASS      574.99 seconds
ScanBuild                     PASS      1013.17 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v2,2/2] monitor: fix parsing of ISO packet data header and slen check
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#98: 
Assisted-by: GLM-5.2

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'GLM-5.2'
#98: 
Assisted-by: GLM-5.2

/github/workspace/src/patch/14679169.patch total: 1 errors, 1 warnings, 106 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14679169.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2002:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3924:52: warning: array of flexible structuresmonitor/bt.h:3912:40: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2295

---
Regards,
Linux Bluetooth