[PATCH] Bluetooth: hci_core: Explicitly kfree_skb() HCI_DRV_PKT and HCI_DIAG_PKT frames

[PATCH] Bluetooth: hci_core: Explicitly kfree_skb() HCI_DRV_PKT and HCI_DIAG_PKT frames

[Zijun Hu]

In hci_rx_work(), HCI_DRV_PKT and HCI_DIAG_PKT rely on the default
case to free them, and cause:

- They get mixed in with unknown packet types (default case).
- It is not clear which packet types the function is handling.

Fix by giving both their own case that kfree_skb()s explicitly.

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 net/bluetooth/hci_core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d1e78ae7728e..1e324c05af24 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4057,6 +4057,14 @@ static void hci_rx_work(struct work_struct *work)
 			hci_isodata_packet(hdev, skb);
 			break;
 
+		case HCI_DRV_PKT:
+			kfree_skb(skb);
+			break;
+
+		case HCI_DIAG_PKT:
+			kfree_skb(skb);
+			break;
+
 		default:
 			kfree_skb(skb);
 			break;

---
base-commit: bd8bee79e1fa8db2d587733f8b6fd9597b04d6e3
change-id: 20260719-fix_hci_rx_work-f03dd49d8ef8

Best regards,
-- 
Zijun Hu <zijun.hu@oss.qualcomm.com>

RE: Bluetooth: hci_core: Explicitly kfree_skb() HCI_DRV_PKT and HCI_DIAG_PKT frames

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2389 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1130396

---Test result---

Test Summary:
CheckPatch                    PASS      0.74 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      25.67 seconds
CheckAllWarning               PASS      28.27 seconds
CheckSparse                   PASS      26.96 seconds
BuildKernel32                 PASS      25.04 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      459.11 seconds
TestRunner_l2cap-tester       PASS      58.81 seconds
TestRunner_iso-tester         PASS      75.66 seconds
TestRunner_bnep-tester        PASS      19.03 seconds
TestRunner_mgmt-tester        FAIL      213.55 seconds
TestRunner_rfcomm-tester      PASS      25.37 seconds
TestRunner_sco-tester         PASS      31.16 seconds
TestRunner_ioctl-tester       PASS      26.05 seconds
TestRunner_mesh-tester        FAIL      26.01 seconds
TestRunner_smp-tester         PASS      23.09 seconds
TestRunner_userchan-tester    PASS      24.20 seconds
TestRunner_6lowpan-tester     PASS      22.46 seconds
IncrementalBuild              PASS      24.52 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.245 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.600 seconds
Mesh - Send cancel - 2                               Timed out    1.992 seconds


https://github.com/bluez/bluetooth-next/pull/458

---
Regards,
Linux Bluetooth