RE: [BUG] Bluetooth: stack out-of-bounds write in eir_create_adv_data() and eir_create_scan_rsp() when a controller stops reporting LE Extended Advertising (seen on 7.3.1)

[bluez.test.bot@gmail.com]

[-- Attachment #1: Type: text/plain, Size: 5619 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1206772/

---Test result---

Test Summary:
CheckPatch                    FAIL      1.10 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.28 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   PASS      23.29 seconds
CheckAllWarning               PASS      27.44 seconds
CheckSparse                   PASS      29.76 seconds
BuildKernel32                 PASS      24.16 seconds
CheckKernelLLVM               PASS      25.02 seconds
TestRunnerSetup               PASS      546.22 seconds
TestRunner_l2cap-tester       PASS      13.15 seconds
TestRunner_iso-tester         PASS      11.47 seconds
TestRunner_bnep-tester        PASS      2.92 seconds
TestRunner_mgmt-tester        PASS      83.84 seconds
TestRunner_rfcomm-tester      PASS      4.13 seconds
TestRunner_sco-tester         PASS      5.19 seconds
TestRunner_ioctl-tester       PASS      4.32 seconds
TestRunner_mesh-tester        PASS      5.18 seconds
TestRunner_smp-tester         PASS      4.04 seconds
TestRunner_userchan-tester    PASS      2.96 seconds
TestRunner_6lowpan-tester     PASS      4.10 seconds
IncrementalBuild              PASS      22.42 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BUG] Bluetooth: stack out-of-bounds write in eir_create_adv_data() and eir_create_scan_rsp() when a controller stops reporting LE Extended Advertising (seen on 7.3.1)
WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#144: 
In both cases a 220-byte memcpy() writes to a 31-byte buffer that is part of

ERROR: Avoid using diff content in the commit message - patch(1) might not work
#459: 
@@ -1609,7 +1610,7 @@ static int __hci_set_scan_rsp_data_sync(struct

WARNING: The commit message has 'Call Trace:', perhaps it also needs a 'Fixes:' tag?

ERROR: Missing Signed-off-by: line(s)

total: 2 errors, 2 warnings, 0 checks, 59 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14967012.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BUG] Bluetooth: stack out-of-bounds write in eir_create_adv_data() and eir_create_scan_rsp() when a controller stops reporting LE Extended Advertising (seen on 7.3.1)

1: CC1 Body does not contain a 'Signed-off-by' line
1: T1 Title exceeds max length (167>80): "[BUG] Bluetooth: stack out-of-bounds write in eir_create_adv_data() and eir_create_scan_rsp() when a controller stops reporting LE Extended Advertising (seen on 7.3.1)"
380: B1 Line exceeds max length (90>80): "BUG: KASAN: stack-out-of-bounds in eir_create_adv_data+0x2ab/0x440 net/bluetooth/eir.c:303"
383: B1 Line exceeds max length (99>80): "CPU: 1 UID: 0 PID: 14158 Comm: syz-executor Not tainted 7.3.1-g41f174fd422b-dirty #8 PREEMPT(full) "
383: B2 Line has trailing whitespace: "CPU: 1 UID: 0 PID: 14158 Comm: syz-executor Not tainted 7.3.1-g41f174fd422b-dirty #8 PREEMPT(full) "
384: B1 Line exceeds max length (93>80): "Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014"
415: B1 Line exceeds max length (199>80): "Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00"
440: B1 Line exceeds max length (183>80): "page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 14157, tgid 14157 (syz-executor), ts 13167688309676"
496: B1 Line exceeds max length (90>80): "BUG: KASAN: stack-out-of-bounds in eir_create_scan_rsp+0x119/0x1a0 net/bluetooth/eir.c:360"
499: B1 Line exceeds max length (98>80): "CPU: 3 UID: 0 PID: 9585 Comm: syz-executor Not tainted 7.3.1-g41f174fd422b-dirty #8 PREEMPT(full) "
499: B2 Line has trailing whitespace: "CPU: 3 UID: 0 PID: 9585 Comm: syz-executor Not tainted 7.3.1-g41f174fd422b-dirty #8 PREEMPT(full) "
500: B1 Line exceeds max length (93>80): "Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014"
531: B1 Line exceeds max length (199>80): "Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00"
549: B1 Line exceeds max length (82>80): "page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7f93bfa2d pfn:0x5b5cf"
556: B1 Line exceeds max length (179>80): "page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 9584, tgid 9584 (syz-executor), ts 209124958665"
596: B1 Line exceeds max length (81>80): " drm_fbdev_shmem_helper_fb_dirty+0xcc/0x1c0 drivers/gpu/drm/drm_fbdev_shmem.c:117"


https://github.com/bluez/bluetooth-next/pull/1101

---
Regards,
Linux Bluetooth