From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B202606A31C for ; Wed, 21 Oct 2026 07:24:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=RRlGLNqW; dkim=pass (1024-bit key, unprotected) header.d=mediatek.com header.i=@mediatek.com header.a=rsa-sha256 header.s=dk header.b=MNvdkgAi DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:CC:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=3g0aFFqcRMK1xCooXVxIr/uzTUiT7C6yFr6obAG6xIQ=; b=RRlGLNqWRm5XsgnrqsIj66T1ck PftdgJjEsUAaxaMGDXdg1N1txYpcebjHSshaM8SU88E/6t+n+F3IPvP1xEiexS85E4eJiwyK7whL9 p7J+enO8E/X1lB4VPvHb+gF4eC/X9XpVvQdsah/EUaOElgu/ZdlbSDJGo6fq4ovDZvvJUjXFb8i27 AWdEB1LHiP8VPIhg0xTSGxKJH4v3+Gw59w0i5NkPL8AJlbonM3ubiXqIvsUkAfvAHyrW9XZC8Zk5H +V75pzRxKwacAstzR8LiGxryEM4ZfLFiin5j1ZCIp9BQypw+8ixe4gzClHmhObaAYpLy14lgfbUQm 8m72opig==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xJQgB-0000000BFUk-1xb5; Wed, 21 Oct 2026 07:24:07 +0000 Received: from [216.200.240.185] (helo=mailgw02.mediatek.com) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xJQg8-0000000BFTG-3fEg for linux-mediatek@lists.infradead.org; Wed, 21 Oct 2026 07:24:05 +0000 X-UUID: 62bf9670cd2011f1acbe4559397dec65-20261021 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=3g0aFFqcRMK1xCooXVxIr/uzTUiT7C6yFr6obAG6xIQ=; b=MNvdkgAif4zG3R6SPUZlETdeGn/nDJUaP/NIeGBXj6EH0pIhX7F2+Fr2YDvE5TQS9wIVLnqS3UdgcfVt/y5slMkz4dm1XlKjCpVY28cfV37WKfj5MTzpwMN+41PaPjgwVlJGV8akgTBIqadpG0zRBfrZ3YSmQzhgColP5LiVVcY=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.20,REQID:975e9c02-6012-4519-b1af-f90229812951,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:291e20b,CLOUDID:10d343ce-02bc-447e-ab88-2baec399874a,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL:0,OSI:0, OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 62bf9670cd2011f1acbe4559397dec65-20261021 Received: from mtkmbs10n1.mediatek.inc [(172.21.101.34)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 871406453; Wed, 21 Oct 2026 00:24:00 -0700 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by MTKMBS09N1.mediatek.inc (172.21.101.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Wed, 21 Oct 2026 15:23:57 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Wed, 21 Oct 2026 15:23:57 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Hao Qin , Wenlong Tian , Sean Wang , Will Lee , SS Wu , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v3 2/3] Bluetooth: btmtk: bound the ISO payload length by the controller's MTU Date: Wed, 21 Oct 2026 15:23:54 +0800 Message-ID: <20261021072356.1449539-3-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20261021072356.1449539-1-chris.lu@mediatek.com> References: <20261021072356.1449539-1-chris.lu@mediatek.com> X-Archived-By: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20261021_002404_958566_7954C760 X-CRM114-Status: GOOD ( 18.29 ) X-Spam-Score: -1.3 (-) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" X-Spam-Status: No, score=-19.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY, USER_AGENT_GIT autolearn=ham autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 btmtk_recv_isopkt() bounds the Data_Total_Length reported by the controller with skb_tailroom(skb) < hci_skb_expect(skb). That keeps the reassembly inside the skb, but it enforces no protocol limit: the head allocation is rounded up to the next kmalloc bucket and skb_tailroom() reports what the bucket can hold rather than what was requested, which is several hundred bytes more. An oversized length therefore passes, and the parser keeps pulling bytes out of the following transfers to fill it, swallowing the real ISO packets they carry until the frame is handed to hci_recv_frame(). The controller reports the largest ISO_Data_Packet_Length it will send in LE Read Buffer Size [v2], which hci_cc_le_read_buffer_size_v2() keeps in hdev->iso_mtu. Once that is available, bound the length by it and size the receive skb to hold that much plus the 4-byte header. HCI_MAX_ISO_SIZE is kept only as a fallback for the window before the command completes. Keep the skb_tailroom() test as well, because a fragment started before hdev->iso_mtu was populated sits in an skb sized for the fallback. Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") Co-developed-by: Hao Qin Signed-off-by: Hao Qin Co-developed-by: Wenlong Tian Signed-off-by: Wenlong Tian Signed-off-by: Chris Lu --- drivers/bluetooth/btmtk.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 63b4c99b20d8..d60e9db0d463 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -1170,8 +1170,15 @@ static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count) struct btmtk_data *btmtk_data = hci_get_priv(hdev); struct sk_buff *skb; unsigned long flags; + unsigned int iso_mtu; int err = 0; + /* The controller reports the largest Data_Total_Length it will send in + * LE Read Buffer Size [v2]. Fall back to HCI_MAX_ISO_SIZE while that + * command has not completed yet. + */ + iso_mtu = hdev->iso_mtu ? hdev->iso_mtu : HCI_MAX_ISO_SIZE; + spin_lock_irqsave(&btmtk_data->isorxlock, flags); skb = btmtk_data->isopkt_skb; @@ -1179,7 +1186,8 @@ static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count) int len; if (!skb) { - skb = bt_skb_alloc(HCI_MAX_ISO_SIZE, GFP_ATOMIC); + skb = bt_skb_alloc(HCI_ISO_HDR_SIZE + iso_mtu, + GFP_ATOMIC); if (!skb) { err = -ENOMEM; break; @@ -1221,7 +1229,13 @@ static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count) break; } - if (skb_tailroom(skb) < hci_skb_expect(skb)) { + /* Reject a length the controller said it would never + * send. The skb_tailroom() test is kept because a + * fragment started before hdev->iso_mtu was populated + * sits in a smaller skb than iso_mtu now allows. + */ + if (hci_skb_expect(skb) > iso_mtu || + skb_tailroom(skb) < hci_skb_expect(skb)) { kfree_skb(skb); skb = NULL; -- 2.45.2