Linux bluetooth development
 help / color / mirror / Atom feed
* [RFC PATCH 0/5] Bluetooth: enable context analysis
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen

Set up compiler context analysis that generate compiler warnings on
problems that Clang -Wthread-safety can detect:

https://docs.kernel.org/dev-tools/context-analysis.html

Clang 22, and probably Clang 23 [1] will be required.  Sparse locking
analysis support was removed in commit
5b63d0ae94ccfd64dcbdb693d88eb3650eb3c64c, this is its successor.

This series enables the analysis and adds minimal annotations to silence
some false positives.

Also, one patch to fix what looks like a legitimate locking issue in
iso.c.

In future, it probably is a good idea to make more use of it and add
__must_hold, __guarded_by etc annotations.

Kernel test robot appears to be checking for these, but not sure in what
trees [2]

BlueZ testbot doesn't check these currently but it's possible to add
https://github.com/bluez/action-ci/pull/4

[1] https://lore.kernel.org/all/CANpmjNN4O=W70sAc5gaVkTAFdrGGOW+XBMyuehfz3_QMiT=uCw@mail.gmail.com/
[2] https://lore.kernel.org/all/202605060005.JYWpZXr2-lkp@intel.com/

Pauli Virtanen (5):
  Bluetooth: af_bluetooth: Add minimal context analysis annotations
  Bluetooth: hci_core: Add minimal context analysis annotations
  Bluetooth: ISO: lock same hdev as what is released
  Bluetooth: L2CAP: Add minimal context analysis annotations
  Bluetooth: enable context analysis

 drivers/bluetooth/Makefile   |  2 ++
 net/bluetooth/Makefile       |  2 ++
 net/bluetooth/af_bluetooth.c |  7 +++++--
 net/bluetooth/hci_core.c     |  3 +++
 net/bluetooth/iso.c          | 14 ++++++++------
 net/bluetooth/l2cap_sock.c   |  1 +
 6 files changed, 21 insertions(+), 8 deletions(-)

-- 
2.54.0


^ permalink raw reply

* [RFC PATCH 2/5] Bluetooth: hci_core: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>

Add minimal compiler context analysis annotations, required for
compilation to pass.

compiler-context-analysis.h doesn't have tools to deal with the
conditional SRCU locking on return value used here, so just disable the
analysis in places.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/hci_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c46c1236ebfa..fa87cb0bcf7b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -65,6 +65,7 @@ static DEFINE_IDA(hci_index_ida);
 /* Get HCI device by index.
  * Device is held on return. */
 static struct hci_dev *__hci_dev_get(int index, int *srcu_index)
+	__context_unsafe(/* conditional locking */)
 {
 	struct hci_dev *hdev = NULL, *d;
 
@@ -92,11 +93,13 @@ struct hci_dev *hci_dev_get(int index)
 }
 
 static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index)
+	__context_unsafe(/* conditional locking vs return */)
 {
 	return __hci_dev_get(index, srcu_index);
 }
 
 static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index)
+	__context_unsafe(/* conditional locking vs return */)
 {
 	srcu_read_unlock(&hdev->srcu, srcu_index);
 	hci_dev_put(hdev);
-- 
2.54.0


^ permalink raw reply related

* [RFC PATCH 1/5] Bluetooth: af_bluetooth: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>

Add minimal compiler context analysis annotations, required for
compilation to pass.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/af_bluetooth.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9d68dd86023c..f42467159947 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -212,6 +212,7 @@ bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
 EXPORT_SYMBOL(bt_sock_linked);
 
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
+	__context_unsafe(/* conditional locking */)
 {
 	const struct cred *old_cred;
 	struct pid *old_pid;
@@ -819,7 +820,8 @@ EXPORT_SYMBOL(bt_sock_wait_ready);
 
 #ifdef CONFIG_PROC_FS
 static void *bt_seq_start(struct seq_file *seq, loff_t *pos)
-	__acquires(seq->private->l->lock)
+	__acquires_shared(&((struct bt_sock_list *)
+			    pde_data(file_inode(seq->file)))->lock)
 {
 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
 
@@ -835,7 +837,8 @@ static void *bt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void bt_seq_stop(struct seq_file *seq, void *v)
-	__releases(seq->private->l->lock)
+	__releases_shared(&((struct bt_sock_list *)
+			    pde_data(file_inode(seq->file)))->lock)
 {
 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
 
-- 
2.54.0


^ permalink raw reply related

* [RFC PATCH 3/5] Bluetooth: ISO: lock same hdev as what is released
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>

bis may be deleted concurrently after release_sock(sk).

To avoid this, lock the hdev obtained in iso_conn_get_hdev that we have
refcount for.  Also, obtain refcount on the hci_conn to avoid comparing
freed pointer in the race check below.

Addresses valid context analysis warning

net/bluetooth/iso.c:1095:2: warning: releasing mutex 'iso_conn_get_hdev(sk->conn).lock'
that was not held [-Wthread-safety-analysis]

Fixes: d3413703d5f8b ("Bluetooth: ISO: Add support to bind to trigger PAST")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/iso.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7cb2864fe872..34991fc7e0a7 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1027,13 +1027,16 @@ static int iso_sock_rebind_bis(struct sock *sk, struct sockaddr_iso *sa,
 	return err;
 }
 
-static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn)
+static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn,
+					 struct hci_conn **hcon)
 {
 	struct hci_dev *hdev = NULL;
 
 	iso_conn_lock(conn);
-	if (conn->hcon)
+	if (conn->hcon) {
 		hdev = hci_dev_hold(conn->hcon->hdev);
+		*hcon = hci_conn_get(conn->hcon);
+	}
 	iso_conn_unlock(conn);
 
 	return hdev;
@@ -1065,18 +1068,16 @@ static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa,
 	if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type))
 		return -EINVAL;
 
-	hdev = iso_conn_get_hdev(iso_pi(sk)->conn);
+	hdev = iso_conn_get_hdev(iso_pi(sk)->conn, &bis);
 	if (!hdev)
 		return -EINVAL;
 
-	bis = iso_pi(sk)->conn->hcon;
-
 	/* Release the socket before lookups since that requires hci_dev_lock
 	 * which shall not be acquired while holding sock_lock for proper
 	 * ordering.
 	 */
 	release_sock(sk);
-	hci_dev_lock(bis->hdev);
+	hci_dev_lock(hdev);
 	lock_sock(sk);
 
 	if (!iso_pi(sk)->conn || iso_pi(sk)->conn->hcon != bis) {
@@ -1093,6 +1094,7 @@ static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa,
 
 unlock:
 	hci_dev_unlock(hdev);
+	hci_conn_put(bis);
 	hci_dev_put(hdev);
 
 	return err;
-- 
2.54.0


^ permalink raw reply related

* [RFC PATCH 4/5] Bluetooth: L2CAP: Add minimal context analysis annotations
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>

Context analysis has what looks like false positive vs. taking
conn->lock in l2cap_sock_shutdown().

chan->conn may be deleted concurrently and become NULL while retaking
chan->lock, but since chan shall not be reused, chan->conn cannot be
replaced by a different l2cap_conn.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/l2cap_sock.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index cf590a67d364..bbf883098b7f 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1336,6 +1336,7 @@ static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
 }
 
 static int l2cap_sock_shutdown(struct socket *sock, int how)
+	__context_unsafe(/* complex chan->conn locking */)
 {
 	struct sock *sk = sock->sk;
 	struct l2cap_chan *chan;
-- 
2.54.0


^ permalink raw reply related

* [RFC PATCH 5/5] Bluetooth: enable context analysis
From: Pauli Virtanen @ 2026-05-16 11:14 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778930064.git.pav@iki.fi>

Enable compiler context analysis for Bluetooth subsystem and drivers.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 drivers/bluetooth/Makefile | 2 ++
 net/bluetooth/Makefile     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index bafc26250b63..e6b1c1180d1d 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -50,3 +50,5 @@ hci_uart-$(CONFIG_BT_HCIUART_AG6XX)	+= hci_ag6xx.o
 hci_uart-$(CONFIG_BT_HCIUART_MRVL)	+= hci_mrvl.o
 hci_uart-$(CONFIG_BT_HCIUART_AML)	+= hci_aml.o
 hci_uart-objs				:= $(hci_uart-y)
+
+CONTEXT_ANALYSIS := y
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 41049b280887..ff466ea97436 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -25,3 +25,5 @@ bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o
 bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o
 bluetooth-$(CONFIG_BT_DEBUGFS) += hci_debugfs.o
 bluetooth-$(CONFIG_BT_SELFTEST) += selftest.o
+
+CONTEXT_ANALYSIS := y
-- 
2.54.0


^ permalink raw reply related

* [bluetooth-next:master] BUILD SUCCESS 6aba94a49bc9cc5477e56053bfe5d70a123f9aed
From: kernel test robot @ 2026-05-16 12:22 UTC (permalink / raw)
  To: Luiz Augusto von Dentz; +Cc: linux-bluetooth

tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
branch HEAD: 6aba94a49bc9cc5477e56053bfe5d70a123f9aed  Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

elapsed time: 1118m

configs tested: 222
configs skipped: 11

The following configs have been built successfully.
More configs may be tested in the coming days.

tested configs:
alpha                             allnoconfig    gcc-15.2.0
alpha                            allyesconfig    gcc-15.2.0
alpha                               defconfig    gcc-15.2.0
arc                              allmodconfig    clang-16
arc                              allmodconfig    gcc-15.2.0
arc                               allnoconfig    gcc-15.2.0
arc                              allyesconfig    clang-23
arc                              allyesconfig    gcc-15.2.0
arc                                 defconfig    gcc-15.2.0
arc                            randconfig-001    gcc-8.5.0
arc                   randconfig-001-20260516    gcc-8.5.0
arc                            randconfig-002    gcc-8.5.0
arc                   randconfig-002-20260516    gcc-8.5.0
arm                               allnoconfig    clang-23
arm                               allnoconfig    gcc-15.2.0
arm                              allyesconfig    clang-16
arm                              allyesconfig    gcc-15.2.0
arm                                 defconfig    gcc-15.2.0
arm                            randconfig-001    gcc-8.5.0
arm                   randconfig-001-20260516    gcc-8.5.0
arm                            randconfig-002    gcc-8.5.0
arm                   randconfig-002-20260516    gcc-8.5.0
arm                            randconfig-003    gcc-8.5.0
arm                   randconfig-003-20260516    gcc-8.5.0
arm                            randconfig-004    gcc-8.5.0
arm                   randconfig-004-20260516    gcc-8.5.0
arm64                            allmodconfig    clang-19
arm64                            allmodconfig    clang-23
arm64                             allnoconfig    gcc-15.2.0
arm64                               defconfig    gcc-15.2.0
arm64                 randconfig-001-20260516    gcc-9.5.0
arm64                 randconfig-002-20260516    gcc-9.5.0
arm64                 randconfig-003-20260516    gcc-9.5.0
arm64                 randconfig-004-20260516    gcc-9.5.0
csky                             allmodconfig    gcc-15.2.0
csky                              allnoconfig    gcc-15.2.0
csky                                defconfig    gcc-15.2.0
csky                  randconfig-001-20260516    gcc-9.5.0
csky                  randconfig-002-20260516    gcc-9.5.0
hexagon                          allmodconfig    clang-17
hexagon                          allmodconfig    gcc-15.2.0
hexagon                           allnoconfig    clang-23
hexagon                           allnoconfig    gcc-15.2.0
hexagon                             defconfig    gcc-15.2.0
hexagon               randconfig-001-20260516    gcc-11.5.0
hexagon               randconfig-002-20260516    gcc-11.5.0
i386                             alldefconfig    gcc-14
i386                             allmodconfig    clang-20
i386                             allmodconfig    gcc-14
i386                              allnoconfig    gcc-14
i386                              allnoconfig    gcc-15.2.0
i386                             allyesconfig    clang-20
i386                 buildonly-randconfig-001    clang-20
i386        buildonly-randconfig-001-20260516    clang-20
i386                 buildonly-randconfig-002    clang-20
i386        buildonly-randconfig-002-20260516    clang-20
i386                 buildonly-randconfig-003    clang-20
i386        buildonly-randconfig-003-20260516    clang-20
i386                 buildonly-randconfig-004    clang-20
i386        buildonly-randconfig-004-20260516    clang-20
i386                 buildonly-randconfig-005    clang-20
i386        buildonly-randconfig-005-20260516    clang-20
i386                 buildonly-randconfig-006    clang-20
i386        buildonly-randconfig-006-20260516    clang-20
i386                                defconfig    gcc-15.2.0
i386                           randconfig-001    clang-20
i386                  randconfig-001-20260516    clang-20
i386                           randconfig-002    clang-20
i386                  randconfig-002-20260516    clang-20
i386                           randconfig-003    clang-20
i386                  randconfig-003-20260516    clang-20
i386                           randconfig-004    clang-20
i386                  randconfig-004-20260516    clang-20
i386                           randconfig-005    clang-20
i386                  randconfig-005-20260516    clang-20
i386                           randconfig-006    clang-20
i386                  randconfig-006-20260516    clang-20
i386                           randconfig-007    clang-20
i386                  randconfig-007-20260516    clang-20
i386                  randconfig-011-20260516    gcc-14
i386                  randconfig-012-20260516    gcc-14
i386                  randconfig-013-20260516    gcc-14
i386                  randconfig-014-20260516    gcc-14
i386                  randconfig-015-20260516    gcc-14
i386                  randconfig-016-20260516    gcc-14
i386                  randconfig-017-20260516    gcc-14
loongarch                        allmodconfig    clang-19
loongarch                        allmodconfig    clang-23
loongarch                         allnoconfig    clang-23
loongarch                         allnoconfig    gcc-15.2.0
loongarch                           defconfig    clang-19
loongarch             randconfig-001-20260516    gcc-11.5.0
loongarch             randconfig-002-20260516    gcc-11.5.0
m68k                             allmodconfig    gcc-15.2.0
m68k                              allnoconfig    gcc-15.2.0
m68k                             allyesconfig    clang-16
m68k                             allyesconfig    gcc-15.2.0
m68k                                defconfig    clang-19
microblaze                        allnoconfig    gcc-15.2.0
microblaze                       allyesconfig    gcc-15.2.0
microblaze                          defconfig    clang-19
mips                             allmodconfig    gcc-15.2.0
mips                              allnoconfig    gcc-15.2.0
mips                             allyesconfig    gcc-15.2.0
mips                           ip32_defconfig    clang-23
nios2                            allmodconfig    clang-23
nios2                            allmodconfig    gcc-11.5.0
nios2                             allnoconfig    clang-23
nios2                             allnoconfig    gcc-11.5.0
nios2                               defconfig    clang-19
nios2                 randconfig-001-20260516    gcc-11.5.0
nios2                 randconfig-002-20260516    gcc-11.5.0
openrisc                         allmodconfig    clang-23
openrisc                         allmodconfig    gcc-15.2.0
openrisc                          allnoconfig    clang-23
openrisc                          allnoconfig    gcc-15.2.0
openrisc                            defconfig    gcc-15.2.0
parisc                           allmodconfig    gcc-15.2.0
parisc                            allnoconfig    clang-23
parisc                            allnoconfig    gcc-15.2.0
parisc                           allyesconfig    clang-19
parisc                           allyesconfig    gcc-15.2.0
parisc                              defconfig    gcc-15.2.0
parisc                randconfig-001-20260516    gcc-12.5.0
parisc                randconfig-002-20260516    gcc-12.5.0
parisc64                            defconfig    clang-19
powerpc                          allmodconfig    gcc-15.2.0
powerpc                           allnoconfig    clang-23
powerpc                           allnoconfig    gcc-15.2.0
powerpc               randconfig-001-20260516    gcc-12.5.0
powerpc               randconfig-002-20260516    gcc-12.5.0
powerpc                     tqm8560_defconfig    gcc-15.2.0
powerpc64             randconfig-001-20260516    gcc-12.5.0
powerpc64             randconfig-002-20260516    gcc-12.5.0
riscv                            allmodconfig    clang-23
riscv                             allnoconfig    clang-23
riscv                             allnoconfig    gcc-15.2.0
riscv                            allyesconfig    clang-16
riscv                               defconfig    gcc-15.2.0
riscv                 randconfig-001-20260516    gcc-15.2.0
riscv                 randconfig-002-20260516    gcc-15.2.0
s390                             allmodconfig    clang-18
s390                             allmodconfig    clang-19
s390                              allnoconfig    clang-23
s390                             allyesconfig    gcc-15.2.0
s390                                defconfig    gcc-15.2.0
s390                  randconfig-001-20260516    gcc-15.2.0
s390                  randconfig-002-20260516    gcc-15.2.0
sh                               allmodconfig    gcc-15.2.0
sh                                allnoconfig    clang-23
sh                                allnoconfig    gcc-15.2.0
sh                               allyesconfig    clang-19
sh                               allyesconfig    gcc-15.2.0
sh                                  defconfig    gcc-14
sh                    randconfig-001-20260516    gcc-15.2.0
sh                    randconfig-002-20260516    gcc-15.2.0
sparc                             allnoconfig    clang-23
sparc                             allnoconfig    gcc-15.2.0
sparc                               defconfig    gcc-15.2.0
sparc                 randconfig-001-20260516    gcc-8.5.0
sparc                 randconfig-002-20260516    gcc-8.5.0
sparc64                          allmodconfig    clang-23
sparc64                             defconfig    gcc-14
sparc64               randconfig-001-20260516    gcc-8.5.0
sparc64               randconfig-002-20260516    gcc-8.5.0
um                               allmodconfig    clang-19
um                                allnoconfig    clang-23
um                               allyesconfig    gcc-14
um                               allyesconfig    gcc-15.2.0
um                                  defconfig    gcc-14
um                             i386_defconfig    gcc-14
um                    randconfig-001-20260516    gcc-8.5.0
um                    randconfig-002-20260516    gcc-8.5.0
um                           x86_64_defconfig    gcc-14
x86_64                           allmodconfig    clang-20
x86_64                            allnoconfig    clang-20
x86_64                            allnoconfig    clang-23
x86_64                           allyesconfig    clang-20
x86_64      buildonly-randconfig-001-20260516    gcc-14
x86_64      buildonly-randconfig-002-20260516    gcc-14
x86_64      buildonly-randconfig-003-20260516    gcc-14
x86_64      buildonly-randconfig-004-20260516    gcc-14
x86_64      buildonly-randconfig-005-20260516    gcc-14
x86_64      buildonly-randconfig-006-20260516    gcc-14
x86_64                              defconfig    gcc-14
x86_64                                  kexec    clang-20
x86_64                randconfig-001-20260516    gcc-14
x86_64                randconfig-002-20260516    gcc-14
x86_64                randconfig-003-20260516    gcc-14
x86_64                randconfig-004-20260516    gcc-14
x86_64                randconfig-005-20260516    gcc-14
x86_64                randconfig-006-20260516    gcc-14
x86_64                         randconfig-011    clang-20
x86_64                randconfig-011-20260516    clang-20
x86_64                         randconfig-012    clang-20
x86_64                randconfig-012-20260516    clang-20
x86_64                         randconfig-013    clang-20
x86_64                randconfig-013-20260516    clang-20
x86_64                         randconfig-014    clang-20
x86_64                randconfig-014-20260516    clang-20
x86_64                         randconfig-015    clang-20
x86_64                randconfig-015-20260516    clang-20
x86_64                         randconfig-016    clang-20
x86_64                randconfig-016-20260516    clang-20
x86_64                randconfig-071-20260516    gcc-14
x86_64                randconfig-072-20260516    gcc-14
x86_64                randconfig-073-20260516    gcc-14
x86_64                randconfig-074-20260516    gcc-14
x86_64                randconfig-075-20260516    gcc-14
x86_64                randconfig-076-20260516    gcc-14
x86_64                               rhel-9.4    clang-20
x86_64                           rhel-9.4-bpf    gcc-14
x86_64                          rhel-9.4-func    clang-20
x86_64                    rhel-9.4-kselftests    clang-20
x86_64                         rhel-9.4-kunit    gcc-14
x86_64                           rhel-9.4-ltp    gcc-14
x86_64                          rhel-9.4-rust    clang-20
xtensa                            allnoconfig    clang-23
xtensa                            allnoconfig    gcc-15.2.0
xtensa                           allyesconfig    clang-23
xtensa                randconfig-001-20260516    gcc-8.5.0
xtensa                randconfig-002-20260516    gcc-8.5.0

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply

* RE: Bluetooth: enable context analysis
From: bluez.test.bot @ 2026-05-16 12:46 UTC (permalink / raw)
  To: linux-bluetooth, pav
In-Reply-To: <342a530a1756cfd136542a33e5d947fd6c0a85d2.1778930064.git.pav@iki.fi>

[-- Attachment #1: Type: text/plain, Size: 2120 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095802

---Test result---

Test Summary:
CheckPatch                    PASS      3.56 seconds
GitLint                       FAIL      1.79 seconds
SubjectPrefix                 PASS      0.59 seconds
BuildKernel                   PASS      26.34 seconds
CheckAllWarning               PASS      29.76 seconds
CheckSparse                   PASS      30.21 seconds
BuildKernel32                 PASS      28.37 seconds
TestRunnerSetup               PASS      552.61 seconds
TestRunner_l2cap-tester       PASS      379.41 seconds
TestRunner_iso-tester         PASS      591.09 seconds
TestRunner_bnep-tester        PASS      18.71 seconds
TestRunner_mgmt-tester        PASS      2023.25 seconds
TestRunner_rfcomm-tester      PASS      63.64 seconds
TestRunner_sco-tester         PASS      141.94 seconds
TestRunner_ioctl-tester       PASS      133.61 seconds
TestRunner_mesh-tester        PASS      60.34 seconds
TestRunner_smp-tester         PASS      18.18 seconds
TestRunner_userchan-tester    PASS      19.47 seconds
TestRunner_6lowpan-tester     PASS      51.14 seconds
IncrementalBuild              PASS      32.11 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[RFC,3/5] Bluetooth: ISO: lock same hdev as what is released

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
11: B1 Line exceeds max length (87>80): "net/bluetooth/iso.c:1095:2: warning: releasing mutex 'iso_conn_get_hdev(sk->conn).lock'"


https://github.com/bluez/bluetooth-next/pull/202

---
Regards,
Linux Bluetooth


^ permalink raw reply

* [PATCH v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: Safa Karakuş @ 2026-05-16 18:15 UTC (permalink / raw)
  To: linux-bluetooth
  Cc: Luiz Augusto von Dentz, Marcel Holtmann, stable, linux-kernel,
	Safa Karakuş
In-Reply-To: <20260516092139.2618159-1-safa.karakus@secunnix.com>

bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
accept queue and release_sock()s it before returning, so the returned
sk has no caller reference and is unlocked.

l2cap_sock_cleanup_listen() walks these children on listening-socket
close.  A concurrent HCI disconnect drives hci_rx_work ->
l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
frees the child sk and its l2cap_chan; cleanup_listen() then uses both:

  BUG: KASAN: slab-use-after-free in l2cap_sock_kill
    l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
  Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill

This is distinct from the two fixes already in this area: commit
e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the
accept_q list/poll and takes temporary refs inside bt_accept_dequeue(),
and CVE-2025-39860 serialises the userspace close()/accept() race by
calling cleanup_listen() under lock_sock() in l2cap_sock_release().
Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF
still reproduces on current bluetooth/master.

Take the reference at the source: bt_accept_dequeue() does sock_hold()
while sk is still locked, before release_sock(); callers sock_put().
cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under
a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops
it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on
SOCK_DEAD.  conn->lock is not taken here: cleanup_listen() runs under
the parent sk lock and that would invert
conn->lock -> chan->lock -> sk_lock (lockdep).

KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced
12 use-after-free reports per run before this change; 0, and no lockdep
report, over 1600+ raced iterations after it on bluetooth/master.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Cc: stable@vger.kernel.org
Signed-off-by: Safa Karakuş <safa.karakus@secunnix.com>
---
Hi Luiz,

v4 - rebased on current bluetooth/master (after e83f5e24d "serialize
accept_q access"); the af_bluetooth.c hunk now sits in the reworked
bt_accept_dequeue().  This residual (cleanup_listen vs l2cap_conn_del,
not covered by e83f5e24d nor CVE-2025-39860) is unchanged from v3 and
re-verified with KASAN on bluetooth/master: 12 UAF/run -> 0, no
lockdep, over 1600+ raced iterations.

Changes since v3: rebased onto e83f5e24d; commit message notes why
e83f5e24d/CVE-2025-39860 do not cover this path.
Changes since v2: fix at the source in bt_accept_dequeue() + chan
lifetime via l2cap_chan_hold_unless_zero(); no conn->lock (lockdep).
Changes since v1: consistent From/Signed-off-by.

 net/bluetooth/af_bluetooth.c | 10 +++++++
 net/bluetooth/iso.c          |  9 ++++++-
 net/bluetooth/l2cap_sock.c   | 51 +++++++++++++++++++++++++++++++-----
 net/bluetooth/rfcomm/sock.c  |  9 ++++++-
 net/bluetooth/sco.c          |  9 ++++++-
 5 files changed, 78 insertions(+), 10 deletions(-)

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9d68dd860..1a6aa3f8d 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -340,6 +340,16 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
 			if (newsock)
 				sock_graft(sk, newsock);
 
+			/* Hand the caller a reference taken while sk is
+			 * still locked.  bt_accept_unlink() just dropped
+			 * the accept-queue reference; without this hold a
+			 * concurrent teardown (e.g. l2cap_conn_del() ->
+			 * l2cap_sock_kill()) could free sk between
+			 * release_sock() and the caller using it.  Every
+			 * caller drops this with sock_put() when done.
+			 */
+			sock_hold(sk);
+
 			release_sock(sk);
 			if (next)
 				sock_put(next);
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7cb2864fe..812f9002d 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -751,6 +751,8 @@ static void iso_sock_cleanup_listen(struct sock *parent)
 	while ((sk = bt_accept_dequeue(parent, NULL))) {
 		iso_sock_close(sk);
 		iso_sock_kill(sk);
+		/* Drop the reference handed back by bt_accept_dequeue(). */
+		sock_put(sk);
 	}
 
 	/* If listening socket has a hcon, properly disconnect it */
@@ -1356,8 +1358,13 @@ static int iso_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		ch = bt_accept_dequeue(sk, newsock);
-		if (ch)
+		if (ch) {
+			/* Drop the bridging ref from bt_accept_dequeue();
+			 * the grafted socket keeps ch alive from here.
+			 */
+			sock_put(ch);
 			break;
+		}
 
 		if (!timeo) {
 			err = -EAGAIN;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index cf590a67d..b34e7da8d 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -349,8 +349,13 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		nsk = bt_accept_dequeue(sk, newsock);
-		if (nsk)
+		if (nsk) {
+			/* Drop the bridging ref from bt_accept_dequeue();
+			 * the grafted socket keeps nsk alive from here.
+			 */
+			sock_put(nsk);
 			break;
+		}
 
 		if (!timeo) {
 			err = -EAGAIN;
@@ -1475,22 +1480,54 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
 	BT_DBG("parent %p state %s", parent,
 	       state_to_string(parent->sk_state));
 
-	/* Close not yet accepted channels */
+	/* Close not yet accepted channels.
+	 *
+	 * bt_accept_dequeue() now returns sk with an extra reference held
+	 * (taken while sk was still locked) so a concurrent l2cap_conn_del()
+	 * -> l2cap_sock_kill() cannot free sk under us.
+	 *
+	 * cleanup_listen() runs under the parent sk lock, so unlike
+	 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would
+	 * establish sk_lock -> conn->lock and invert the established
+	 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock).
+	 *
+	 * Instead, briefly take the child sk lock to fetch and pin its chan.
+	 * l2cap_conn_del() reaches the chan free only via
+	 * l2cap_chan_del() -> l2cap_sock_teardown_cb(), which itself takes
+	 * the child sk lock; holding it across l2cap_chan_hold_unless_zero()
+	 * therefore guarantees the chan cannot be freed while we read and
+	 * pin it (hold_unless_zero() additionally skips a chan already past
+	 * its last reference).  We then drop the sk lock before taking
+	 * chan->lock, so sk and chan locks are never held together.
+	 */
 	while ((sk = bt_accept_dequeue(parent, NULL))) {
-		struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+		struct l2cap_chan *chan;
+
+		lock_sock_nested(sk, L2CAP_NESTING_NORMAL);
+		chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
+		release_sock(sk);
+		if (!chan) {
+			/* l2cap_conn_del() already tearing this child down */
+			sock_put(sk);
+			continue;
+		}
 
 		BT_DBG("child chan %p state %s", chan,
 		       state_to_string(chan->state));
 
-		l2cap_chan_hold(chan);
 		l2cap_chan_lock(chan);
-
 		__clear_chan_timer(chan);
 		l2cap_chan_close(chan, ECONNRESET);
-		l2cap_sock_kill(sk);
-
+		/* l2cap_conn_del() may already have killed this socket
+		 * (it sets SOCK_DEAD); skip the duplicate to avoid a
+		 * double sock_put()/l2cap_chan_put().
+		 */
+		if (!sock_flag(sk, SOCK_DEAD))
+			l2cap_sock_kill(sk);
 		l2cap_chan_unlock(chan);
+
 		l2cap_chan_put(chan);
+		sock_put(sk);
 	}
 }
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index be6639cd6..bd7d959c6 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -180,6 +180,8 @@ static void rfcomm_sock_cleanup_listen(struct sock *parent)
 	while ((sk = bt_accept_dequeue(parent, NULL))) {
 		rfcomm_sock_close(sk);
 		rfcomm_sock_kill(sk);
+		/* Drop the reference handed back by bt_accept_dequeue(). */
+		sock_put(sk);
 	}
 
 	parent->sk_state  = BT_CLOSED;
@@ -497,8 +499,13 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		nsk = bt_accept_dequeue(sk, newsock);
-		if (nsk)
+		if (nsk) {
+			/* Drop the bridging ref from bt_accept_dequeue();
+			 * the grafted socket keeps nsk alive from here.
+			 */
+			sock_put(nsk);
 			break;
+		}
 
 		if (!timeo) {
 			err = -EAGAIN;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index eba44525d..f1799c6a6 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -502,6 +502,8 @@ static void sco_sock_cleanup_listen(struct sock *parent)
 	while ((sk = bt_accept_dequeue(parent, NULL))) {
 		sco_sock_close(sk);
 		sco_sock_kill(sk);
+		/* Drop the reference handed back by bt_accept_dequeue(). */
+		sock_put(sk);
 	}
 
 	parent->sk_state  = BT_CLOSED;
@@ -765,8 +767,13 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		ch = bt_accept_dequeue(sk, newsock);
-		if (ch)
+		if (ch) {
+			/* Drop the bridging ref from bt_accept_dequeue();
+			 * the grafted socket keeps ch alive from here.
+			 */
+			sock_put(ch);
 			break;
+		}
 
 		if (!timeo) {
 			err = -EAGAIN;
-- 
2.34.1


^ permalink raw reply related

* Re: [PATCH] Bluetooth: btmtk: Fix FUNC_CTRL parsing for devices with zero-length payloads
From: Tristan Madani @ 2026-05-16 19:15 UTC (permalink / raw)
  To: shivamkalra98
  Cc: marcel, luiz.dentz, matthias.bgg, angelogioacchino.delregno,
	luiz.von.dentz, linux-bluetooth, linux-kernel, linux-arm-kernel,
	linux-mediatek, stable
In-Reply-To: <20260514-bluetooh-fix-mt7922-v1-1-499c878af1e5@zohomail.in>

On Thu, 14 May 2026 23:18:13 +0530, Shivam Kalra wrote:
> Fix this by making skb_pull_data() conditional: if the status payload is
> present, parse it as before; if omitted, default to BTMTK_WMT_ON_UNDONE.

Makes sense. The original check was too strict for devices that
legitimately omit the status field on FUNC_CTRL responses.

Reviewed-by: Tristan Madani <tristan@talencesecurity.com>

^ permalink raw reply

* RE: [v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: bluez.test.bot @ 2026-05-16 20:47 UTC (permalink / raw)
  To: linux-bluetooth, safa.karakus
In-Reply-To: <20260516181504.3076260-1-safa.karakus@secunnix.com>

[-- Attachment #1: Type: text/plain, Size: 1482 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095877

---Test result---

Test Summary:
CheckPatch                    PASS      1.32 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      23.87 seconds
CheckAllWarning               PASS      26.65 seconds
CheckSparse                   PASS      25.16 seconds
BuildKernel32                 PASS      23.25 seconds
TestRunnerSetup               PASS      518.74 seconds
TestRunner_l2cap-tester       PASS      375.73 seconds
TestRunner_iso-tester         PASS      596.04 seconds
TestRunner_bnep-tester        PASS      18.18 seconds
TestRunner_mgmt-tester        PASS      2021.60 seconds
TestRunner_rfcomm-tester      PASS      62.71 seconds
TestRunner_sco-tester         PASS      140.77 seconds
TestRunner_ioctl-tester       PASS      133.16 seconds
TestRunner_mesh-tester        PASS      59.48 seconds
TestRunner_smp-tester         PASS      17.61 seconds
TestRunner_userchan-tester    PASS      18.69 seconds
TestRunner_6lowpan-tester     PASS      50.66 seconds
IncrementalBuild              PASS      22.44 seconds



https://github.com/bluez/bluetooth-next/pull/203

---
Regards,
Linux Bluetooth


^ permalink raw reply

* Re: [PATCH v4] Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
From: Hillf Danton @ 2026-05-16 22:40 UTC (permalink / raw)
  To: Safa Karakus
  Cc: linux-bluetooth, Luiz Augusto von Dentz, Marcel Holtmann, stable,
	linux-kernel
In-Reply-To: <20260516181504.3076260-1-safa.karakus@secunnix.com>

On Sat, 16 May 2026 21:15:04 +0300 Safa Karakus wrote:
> bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
> accept queue and release_sock()s it before returning, so the returned
> sk has no caller reference and is unlocked.
> 
> l2cap_sock_cleanup_listen() walks these children on listening-socket
> close.  A concurrent HCI disconnect drives hci_rx_work ->
> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
> frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
> 
>   BUG: KASAN: slab-use-after-free in l2cap_sock_kill
>     l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
>   Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill
> 
Feel free to add the regular KASAN uaf calltrace to help understand your fix.

^ permalink raw reply

* [PATCH v3] Bluetooth: btintel: Use skb_pull_data return for bounds check
From: Quan Sun @ 2026-05-17  6:01 UTC (permalink / raw)
  To: marcel, luiz.dentz, kiran.k, linux-bluetooth; +Cc: Quan Sun

The length check at the top of btintel_print_fseq_info() verifies
the skb has at least 66 bytes (sizeof(u32) * 16 + 2), but the
function actually consumes 74 bytes (2 * 1 + 18 * 4). When firmware
returns a packet of exactly 66 bytes, the last two skb_pull_data()
calls return NULL, which is passed directly to get_unaligned_le32(),
resulting in a NULL pointer dereference.

Remove the insufficient length check and instead validate every
skb_pull_data() return value, branching to a malformed label that
logs the error and frees the skb.

Fixes: a7ba218a44aa ("Bluetooth: btintel: Print Firmware Sequencer information")
Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>
---
 drivers/bluetooth/btintel.c | 106 +++++++++++++++++++++++++++---------
 1 file changed, 79 insertions(+), 27 deletions(-)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 5e9cac090bd8..0c42ee53fe2e 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3358,14 +3358,9 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
 		return;
 	}
 
-	if (skb->len < (sizeof(u32) * 16 + 2)) {
-		bt_dev_dbg(hdev, "Malformed packet of length %u received",
-			   skb->len);
-		kfree_skb(skb);
-		return;
-	}
-
 	p = skb_pull_data(skb, 1);
+	if (!p)
+		goto malformed;
 	if (*p) {
 		bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p);
 		kfree_skb(skb);
@@ -3373,6 +3368,8 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
 	}
 
 	p = skb_pull_data(skb, 1);
+	if (!p)
+		goto malformed;
 	switch (*p) {
 	case 0:
 		str = "Success";
@@ -3396,65 +3393,120 @@ void btintel_print_fseq_info(struct hci_dev *hdev)
 
 	bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Reason: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Global version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val);
 
-	p = skb->data;
-	skb_pull_data(skb, 4);
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
 	bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
 		    p[2], p[3]);
 
-	p = skb->data;
-	skb_pull_data(skb, 4);
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
 	bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
 		    p[2], p[3]);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val);
 
-	val = get_unaligned_le32(skb_pull_data(skb, 4));
+	p = skb_pull_data(skb, 4);
+	if (!p)
+		goto malformed;
+	val = get_unaligned_le32(p);
 	bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val);
 
 	kfree_skb(skb);
+	return;
+
+malformed:
+	bt_dev_dbg(hdev, "Malformed packet received");
+	kfree_skb(skb);
 }
 EXPORT_SYMBOL_GPL(btintel_print_fseq_info);
 
-- 
2.34.1


^ permalink raw reply related

* [Bug 221524] Intel 8265 Bluetooth regression (BLE hearing aid unusable) in kernel 6.12 vs 6.1
From: bugzilla-daemon @ 2026-05-17  7:47 UTC (permalink / raw)
  To: linux-bluetooth
In-Reply-To: <bug-221524-62941@https.bugzilla.kernel.org/>

https://bugzilla.kernel.org/show_bug.cgi?id=221524

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |NEEDINFO

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

^ permalink raw reply

* RE: [v3] Bluetooth: btintel: Use skb_pull_data return for bounds check
From: bluez.test.bot @ 2026-05-17  8:24 UTC (permalink / raw)
  To: linux-bluetooth, 2022090917019
In-Reply-To: <20260517060142.24510-1-2022090917019@std.uestc.edu.cn>

[-- Attachment #1: Type: text/plain, Size: 882 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1095975

---Test result---

Test Summary:
CheckPatch                    PASS      0.78 seconds
GitLint                       PASS      0.32 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      25.20 seconds
CheckAllWarning               PASS      27.50 seconds
CheckSparse                   PASS      28.68 seconds
BuildKernel32                 PASS      24.76 seconds
TestRunnerSetup               PASS      525.64 seconds
IncrementalBuild              PASS      23.95 seconds



https://github.com/bluez/bluetooth-next/pull/204

---
Regards,
Linux Bluetooth


^ permalink raw reply

* [PATCH BlueZ] media: use custom DBus timeouts only when remote side is waiting
From: Pauli Virtanen @ 2026-05-17  9:59 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen

Under high system load (VM instance on boot) it's observed the 3 sec
timeout BlueZ uses for BAP broadcast SetConfiguration may be missed by
Wireplumber, as these are set up immediately on startup together with
any other setup (eg ALSA) that may need time.

There's no actual need for using a short custom timeout in BlueZ for
this, as in this case there is no remote side that is waiting for a reply.

Fix by limiting custom timeouts to cases where there is a waiting
remote.  A2DP-specific timeout should be used only for A2DP
SetConfiguration.  Similarly, using timeout for BAP only makes sense for
unicast, and should derive from the ATT timeout.
---
 profiles/audio/media.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index cdaafb04e..0297e4c79 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -71,7 +71,11 @@
 #define MEDIA_ENDPOINT_INTERFACE "org.bluez.MediaEndpoint1"
 #define MEDIA_PLAYER_INTERFACE "org.mpris.MediaPlayer2.Player"
 
-#define REQUEST_TIMEOUT (3 * 1000)		/* 3 seconds */
+/* Timeout should be less than avdtp request timeout (4 seconds) */
+#define A2DP_REQUEST_TIMEOUT_MSEC	(3 * 1000)
+
+/* Timeout should be less than ATT timeout (30 seconds) */
+#define BAP_REQUEST_TIMEOUT_MSEC	(20 * 1000)
 
 struct media_app {
 	struct media_adapter	*adapter;
@@ -465,16 +469,16 @@ static gboolean media_endpoint_async_call(DBusMessage *msg,
 					struct media_transport *transport,
 					media_endpoint_cb_t cb,
 					void *user_data,
-					GDestroyNotify destroy)
+					GDestroyNotify destroy,
+					int timeout_msec)
 {
 	struct endpoint_request *request;
 
 	request = g_new0(struct endpoint_request, 1);
 
-	/* Timeout should be less than avdtp request timeout (4 seconds) */
 	if (g_dbus_send_message_with_reply(btd_get_dbus_connection(),
 						msg, &request->call,
-						REQUEST_TIMEOUT) == FALSE) {
+						timeout_msec) == FALSE) {
 		error("D-Bus send failed");
 		g_free(request);
 		return FALSE;
@@ -521,7 +525,7 @@ static gboolean select_configuration(struct media_endpoint *endpoint,
 					DBUS_TYPE_INVALID);
 
 	return media_endpoint_async_call(msg, endpoint, NULL,
-						cb, user_data, destroy);
+						cb, user_data, destroy, -1);
 }
 
 static int transport_device_cmp(gconstpointer data, gconstpointer user_data)
@@ -604,7 +608,8 @@ static gboolean set_configuration(struct media_endpoint *endpoint,
 	g_dbus_get_properties(conn, path, "org.bluez.MediaTransport1", &iter);
 
 	return media_endpoint_async_call(msg, endpoint, transport,
-						cb, user_data, destroy);
+						cb, user_data, destroy,
+						A2DP_REQUEST_TIMEOUT_MSEC);
 }
 #endif
 
@@ -1093,7 +1098,7 @@ static int pac_select(struct bt_bap_pac *lpac, struct bt_bap_pac *rpac,
 	dbus_message_iter_close_container(&iter, &dict);
 
 	if (!media_endpoint_async_call(msg, endpoint, NULL, pac_select_cb,
-								data, free))
+								data, free, -1))
 		return -EIO;
 
 	return 0;
@@ -1233,6 +1238,7 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 	DBusMessage *msg;
 	DBusMessageIter iter;
 	const char *path;
+	int timeout_msec;
 
 	DBG("endpoint %p stream %p", endpoint, stream);
 
@@ -1243,9 +1249,11 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 	switch (bt_bap_stream_get_type(stream)) {
 	case BT_BAP_STREAM_TYPE_UCAST:
 		transport = pac_ucast_config(stream, cfg, endpoint);
+		timeout_msec = BAP_REQUEST_TIMEOUT_MSEC;
 		break;
 	case BT_BAP_STREAM_TYPE_BCAST:
 		transport = pac_bcast_config(stream, cfg, endpoint);
+		timeout_msec = -1;
 		break;
 	default:
 		transport = NULL;
@@ -1279,7 +1287,8 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 	g_dbus_get_properties(conn, path, "org.bluez.MediaTransport1", &iter);
 
 	if (!media_endpoint_async_call(msg, endpoint, transport,
-						pac_config_cb, data, free))
+						pac_config_cb, data, free,
+						timeout_msec))
 		return -EIO;
 
 	return 0;
-- 
2.54.0


^ permalink raw reply related

* [PATCH BlueZ 1/3] shared/rap: fix use of uninitialized value
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen

Fix error handling in send_ras_segment_data
---
 src/shared/rap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/shared/rap.c b/src/shared/rap.c
index b554726b0..145da2060 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -1096,7 +1096,6 @@ static void send_ras_segment_data(struct bt_rap *rap,
 	uint16_t value_max;
 	const uint16_t header_len = ras_segment_header_size;
 	uint16_t raw_payload_size;
-	bool ok;
 
 	if (!rap || !proc)
 		return;
@@ -1128,6 +1127,7 @@ static void send_ras_segment_data(struct bt_rap *rap,
 		uint16_t seg_len;
 		uint8_t *seg;
 		uint16_t wr = 0;
+		bool ok = true;
 
 		if (index > total_len)
 			index = total_len;
@@ -1180,7 +1180,7 @@ static void send_ras_segment_data(struct bt_rap *rap,
 						wr, bt_rap_get_att(rap));
 
 		/* Try sending to on-demand characteristic */
-		if (ras->ondemand_chrc)
+		if (ras->ondemand_chrc && ok)
 			ok = gatt_db_attribute_notify(ras->ondemand_chrc, seg,
 						wr, bt_rap_get_att(rap));
 
-- 
2.54.0


^ permalink raw reply related

* [PATCH BlueZ 2/3] sdp: Fix integer overflow in sdp_extract_seqtype
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>

Check uint32_t value does not overflow int range.

Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/
---
 lib/bluetooth/sdp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 7210ce0b4..8c0865398 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -1214,6 +1214,7 @@ int sdp_extract_seqtype(const uint8_t *buf, int bufsize, uint8_t *dtdp, int *siz
 {
 	uint8_t dtd;
 	int scanned = sizeof(uint8_t);
+	uint32_t val32;
 
 	if (bufsize < (int) sizeof(uint8_t)) {
 		SDPERR("Unexpected end of packet");
@@ -1249,7 +1250,12 @@ int sdp_extract_seqtype(const uint8_t *buf, int bufsize, uint8_t *dtdp, int *siz
 			SDPERR("Unexpected end of packet");
 			return 0;
 		}
-		*size = bt_get_be32(buf);
+		val32 = bt_get_be32(buf);
+		if (val32 > INT_MAX) {
+			SDPERR("Invalid size");
+			return 0;
+		}
+		*size = val32;
 		scanned += sizeof(uint32_t);
 		break;
 	default:
-- 
2.54.0


^ permalink raw reply related

* [PATCH BlueZ 3/3] main.conf: fix unintentionally set value
From: Pauli Virtanen @ 2026-05-17 10:30 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>

Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.

Restore the value back.
---
 src/main.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main.conf b/src/main.conf
index 39584e225..5846ef92d 100644
--- a/src/main.conf
+++ b/src/main.conf
@@ -289,7 +289,7 @@
 # Export claimed services by plugins
 # Possible values: no, read-only, read-write
 # Default: read-only
-ExportClaimedServices = read-write
+#ExportClaimedServices = read-only
 
 # Security level:
 # Sets security level of ATT channel, setting security anything other than
-- 
2.54.0


^ permalink raw reply related

* [bluez/bluez] 81a4df: build: Fix inclusion of local_node.json and prov_d...
From: Marcel Holtmann @ 2026-05-17 10:39 UTC (permalink / raw)
  To: linux-bluetooth

  Branch: refs/heads/master
  Home:   https://github.com/bluez/bluez
  Commit: 81a4df3e88d7b347244195d05c478d7119c242e2
      https://github.com/bluez/bluez/commit/81a4df3e88d7b347244195d05c478d7119c242e2
  Author: Marcel Holtmann <marcel@holtmann.org>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M Makefile.tools

  Log Message:
  -----------
  build: Fix inclusion of local_node.json and prov_db.json


  Commit: 45e66b1c4aed688e1959d38dbb9834d248d12c2d
      https://github.com/bluez/bluez/commit/45e66b1c4aed688e1959d38dbb9834d248d12c2d
  Author: Marcel Holtmann <marcel@holtmann.org>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M .gitignore

  Log Message:
  -----------
  build: Include test-util binary to ignore list


Compare: https://github.com/bluez/bluez/compare/4f4dba4a7863...45e66b1c4aed

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications

^ permalink raw reply

* [bluez/bluez] 59e580: media: use custom DBus timeouts only when remote s...
From: Pauli Virtanen @ 2026-05-17 10:40 UTC (permalink / raw)
  To: linux-bluetooth

  Branch: refs/heads/1096011
  Home:   https://github.com/bluez/bluez
  Commit: 59e580a3a123be492d9a3361a367a72566bddb8b
      https://github.com/bluez/bluez/commit/59e580a3a123be492d9a3361a367a72566bddb8b
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M profiles/audio/media.c

  Log Message:
  -----------
  media: use custom DBus timeouts only when remote side is waiting

Under high system load (VM instance on boot) it's observed the 3 sec
timeout BlueZ uses for BAP broadcast SetConfiguration may be missed by
Wireplumber, as these are set up immediately on startup together with
any other setup (eg ALSA) that may need time.

There's no actual need for using a short custom timeout in BlueZ for
this, as in this case there is no remote side that is waiting for a reply.

Fix by limiting custom timeouts to cases where there is a waiting
remote.  A2DP-specific timeout should be used only for A2DP
SetConfiguration.  Similarly, using timeout for BAP only makes sense for
unicast, and should derive from the ATT timeout.



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications

^ permalink raw reply

* [bluez/bluez] 37aa6d: shared/rap: fix use of uninitialized value
From: Pauli Virtanen @ 2026-05-17 10:40 UTC (permalink / raw)
  To: linux-bluetooth

  Branch: refs/heads/1096012
  Home:   https://github.com/bluez/bluez
  Commit: 37aa6da047764ef9b07542002bda84ac551a92d6
      https://github.com/bluez/bluez/commit/37aa6da047764ef9b07542002bda84ac551a92d6
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M src/shared/rap.c

  Log Message:
  -----------
  shared/rap: fix use of uninitialized value

Fix error handling in send_ras_segment_data


  Commit: 688a13363b7ddcf8c4bf7039cd2270f60ec7b18f
      https://github.com/bluez/bluez/commit/688a13363b7ddcf8c4bf7039cd2270f60ec7b18f
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M lib/bluetooth/sdp.c

  Log Message:
  -----------
  sdp: Fix integer overflow in sdp_extract_seqtype

Check uint32_t value does not overflow int range.

Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/


  Commit: a023198770010606a847fb1a49afb97ad7c1ed9b
      https://github.com/bluez/bluez/commit/a023198770010606a847fb1a49afb97ad7c1ed9b
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-05-17 (Sun, 17 May 2026)

  Changed paths:
    M src/main.conf

  Log Message:
  -----------
  main.conf: fix unintentionally set value

Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.

Restore the value back.


Compare: https://github.com/bluez/bluez/compare/37aa6da04776%5E...a02319877001

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications

^ permalink raw reply

* RE: [BlueZ,1/3] shared/rap: fix use of uninitialized value
From: bluez.test.bot @ 2026-05-17 11:33 UTC (permalink / raw)
  To: linux-bluetooth, pav
In-Reply-To: <e7e72c0208f579fd6bb63b76f9d2a1ea3cabd2fc.1779013529.git.pav@iki.fi>

[-- Attachment #1: Type: text/plain, Size: 3156 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1096012

---Test result---

Test Summary:
CheckPatch                    FAIL      1.44 seconds
GitLint                       FAIL      1.04 seconds
BuildEll                      PASS      20.18 seconds
BluezMake                     PASS      606.71 seconds
MakeCheck                     PASS      1.05 seconds
MakeDistcheck                 FAIL      219.28 seconds
CheckValgrind                 PASS      203.90 seconds
CheckSmatch                   PASS      326.52 seconds
bluezmakeextell               PASS      166.47 seconds
IncrementalBuild              PASS      628.84 seconds
ScanBuild                     PASS      974.54 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,3/3] main.conf: fix unintentionally set value
ERROR:GIT_COMMIT_ID: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'Commit 31e4fb1498f4 ("monitor: Add decoding support for HIDS 1.1 flags and attributes")'
#88: 
Commit 31e4fb1498f ("monitor: Add decoding support for HIDS 1.1 flags
and attributes") unintentionally set a non-default value in main.conf.

/github/workspace/src/patch/14577223.patch total: 1 errors, 0 warnings, 8 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14577223.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,2/3] sdp: Fix integer overflow in sdp_extract_seqtype

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
5: B1 Line exceeds max length (171>80): "Link: https://lore.kernel.org/linux-bluetooth/ygH6bncNsvf-0Hco92Ae11Lw8-jOfekFO6O3bUvFK8w0DTueny_rwJIF6ffZg2G_XCB4v8h8xRIcAL2b_KwaweNcGa231ZQDHCMpzyvR5i8=@fluentlogic.org/"
##############################
Test: MakeDistcheck - FAIL
Desc: Run Bluez Make Distcheck
Output:

make[4]: *** [Makefile:10239: test-suite.log] Error 1
make[3]: *** [Makefile:10347: check-TESTS] Error 2
make[2]: *** [Makefile:10818: check-am] Error 2
make[1]: *** [Makefile:10820: check] Error 2
make: *** [Makefile:10741: distcheck] Error 1


https://github.com/bluez/bluez/pull/2130

---
Regards,
Linux Bluetooth


^ permalink raw reply

* RE: [BlueZ] media: use custom DBus timeouts only when remote side is waiting
From: bluez.test.bot @ 2026-05-17 11:37 UTC (permalink / raw)
  To: linux-bluetooth, pav
In-Reply-To: <60b9da865b9beb482f914818c31866ebb00960f7.1779011736.git.pav@iki.fi>

[-- Attachment #1: Type: text/plain, Size: 1339 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1096011

---Test result---

Test Summary:
CheckPatch                    PASS      0.32 seconds
GitLint                       PASS      0.20 seconds
BuildEll                      PASS      20.21 seconds
BluezMake                     PASS      660.37 seconds
MakeCheck                     PASS      3.56 seconds
MakeDistcheck                 FAIL      230.19 seconds
CheckValgrind                 PASS      225.47 seconds
CheckSmatch                   PASS      351.66 seconds
bluezmakeextell               PASS      182.49 seconds
IncrementalBuild              PASS      670.58 seconds
ScanBuild                     PASS      1032.73 seconds

Details
##############################
Test: MakeDistcheck - FAIL
Desc: Run Bluez Make Distcheck
Output:

make[4]: *** [Makefile:10239: test-suite.log] Error 1
make[3]: *** [Makefile:10347: check-TESTS] Error 2
make[2]: *** [Makefile:10818: check-am] Error 2
make[1]: *** [Makefile:10820: check] Error 2
make: *** [Makefile:10741: distcheck] Error 1


https://github.com/bluez/bluez/pull/2129

---
Regards,
Linux Bluetooth


^ permalink raw reply

* [PATCH] Bluetooth: SMP: add missing skb len check in smp_cmd_keypress_notify
From: Muhammad Bilal @ 2026-05-17 14:54 UTC (permalink / raw)
  To: linux-bluetooth, linux-kernel
  Cc: marcel, luiz.dentz, johan.hedberg, stable, Muhammad Bilal

smp_cmd_keypress_notify() accesses the received payload as
struct smp_cmd_keypress_notify without verifying that skb->len
contains enough data.

smp_sig_channel() removes the opcode byte before dispatching to
command handlers, so a SMP_CMD_KEYPRESS_NOTIFY packet without a
payload leaves skb->len equal to zero on entry to the handler,
causing a 1-byte out-of-bounds read from the heap.

Add a length check before accessing the payload and return
SMP_INVALID_PARAMS when the packet is too short, matching the
pattern used by other SMP command handlers.

Fixes: 1408bb6efb04 ("Bluetooth: Add dummy handler for LE SC keypress notification")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 net/bluetooth/smp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 98f1da4f5..4c98e2a3a 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2932,6 +2932,9 @@ static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
 {
 	struct smp_cmd_keypress_notify *kp = (void *) skb->data;
 
+	if (skb->len < sizeof(*kp))
+		return SMP_INVALID_PARAMS;
+
 	bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
 
 	return 0;
-- 
2.54.0


^ permalink raw reply related


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox