[PATCH] Bluetooth: msft: Ignore vendor events shorter than the event prefix

[PATCH] Bluetooth: msft: Ignore vendor events shorter than the event prefix

[Adrian.Nguyen-Qualgo]

From: Adrian Nguyen <thenguyen1024@gmail.com>

msft_vendor_evt() is called for every HCI vendor event. When the
controller defines an MSFT event prefix, it pulls the prefix with
msft_skb_pull(), which logs "Malformed MSFT vendor event" when the
event is too short. A vendor event shorter than the prefix cannot be
an MSFT event, though, so it is reported as malformed for nothing.
Before commit 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor
Device Event") such events were dropped silently.

A WCN3990 logs this 20 times at every boot, while btqca downloads its
firmware and the controller answers each segment with a short QCA
vendor event.

Return quietly when the event is shorter than the prefix. Events that
match the prefix but are cut short still get reported.

Fixes: 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor Device Event")
Assisted-by: LLM
Signed-off-by: Adrian Nguyen <thenguyen1024@gmail.com>
---

Notes:
    An LLM helped track down the cause and draft the fix and changelog;
    I reviewed the result and tested it.
    
    Tested on a Vsmart Active 1 (SDM660, WCN3990) with a 7.2-based kernel:
    the errors are gone at boot and hci0 comes up as before. Build-tested
    on bluetooth-next with W=1.

 net/bluetooth/msft.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 6f4b7c38a247..a3f07f35a1b3 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -1082,9 +1082,13 @@ void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 		return;
 
 	/* When the extension has defined an event prefix, check that it
-	 * matches, and otherwise just return.
+	 * matches, and otherwise just return. A vendor event shorter than the
+	 * prefix cannot be an MSFT event, so it is not malformed either.
 	 */
 	if (msft->evt_prefix_len > 0) {
+		if (skb->len < msft->evt_prefix_len)
+			return;
+
 		evt_prefix = msft_skb_pull(hdev, skb, 0, msft->evt_prefix_len);
 		if (!evt_prefix)
 			return;

base-commit: 964430c038967fd06643e866f68115664e1a1bd1
-- 
2.43.0

RE: Bluetooth: msft: Ignore vendor events shorter than the event prefix

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1804 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1183002/

---Test result---

Test Summary:
CheckPatch                    PASS      1.29 seconds
VerifyFixes                   PASS      0.06 seconds
VerifySignedoff               PASS      0.06 seconds
GitLint                       FAIL      1.00 seconds
SubjectPrefix                 PASS      0.05 seconds
BuildKernel                   PASS      29.37 seconds
CheckAllWarning               PASS      34.42 seconds
CheckSparse                   PASS      36.65 seconds
BuildKernel32                 PASS      29.67 seconds
CheckKernelLLVM               PASS      35.30 seconds
TestRunnerSetup               PASS      782.21 seconds
TestRunner_l2cap-tester       PASS      12.64 seconds
TestRunner_iso-tester         PASS      10.78 seconds
TestRunner_bnep-tester        PASS      3.07 seconds
TestRunner_mgmt-tester        PASS      61.46 seconds
TestRunner_rfcomm-tester      PASS      4.41 seconds
TestRunner_sco-tester         PASS      5.52 seconds
TestRunner_ioctl-tester       PASS      4.57 seconds
TestRunner_mesh-tester        PASS      8.82 seconds
TestRunner_smp-tester         PASS      4.26 seconds
TestRunner_userchan-tester    PASS      3.12 seconds
TestRunner_6lowpan-tester     PASS      4.33 seconds
IncrementalBuild              PASS      27.96 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: msft: Ignore vendor events shorter than the event prefix

27: B2 Line has trailing whitespace: "    "


https://github.com/bluez/bluetooth-next/pull/894

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: msft: Ignore vendor events shorter than the event prefix

[Alexey Minnekhanov]

On 10.10.2026 17:08, Adrian.Nguyen-Qualgo wrote:
> From: Adrian Nguyen <thenguyen1024@gmail.com>
> 
> msft_vendor_evt() is called for every HCI vendor event. When the
> controller defines an MSFT event prefix, it pulls the prefix with
> msft_skb_pull(), which logs "Malformed MSFT vendor event" when the
> event is too short. A vendor event shorter than the prefix cannot be
> an MSFT event, though, so it is reported as malformed for nothing.
> Before commit 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor
> Device Event") such events were dropped silently.
> 
> A WCN3990 logs this 20 times at every boot, while btqca downloads its
> firmware and the controller answers each segment with a short QCA
> vendor event.
> 
> Return quietly when the event is shorter than the prefix. Events that
> match the prefix but are cut short still get reported.
> 
> Fixes: 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor Device Event")
> Assisted-by: LLM
> Signed-off-by: Adrian Nguyen <thenguyen1024@gmail.com>
> 

Hi!
I've indeed seen lots of messages like these:

  Bluetooth: hci0: Malformed MSFT vendor event: 0x00

using WCN3990 bluetooth, with this patch I see none.

Tested-by: Alexey Minnekhanov <alexeymin@minlexx.ru>

--
Regards,
Alexey Minnekhanov