[PATCH 3/4] Bluetooth: hci_event: Use 254 as max LE Meta subevent payload length in hci_le_ev_table[]
From: Zijun Hu
Date: Sun Sep 13 2026 - 23:44:32 EST
hci_le_meta_evt() validates skb->len against subev->max_len from the entry
in hci_le_ev_table[], By then, the HCI event header and LE Meta subevent
header have already been stripped by skb_pull(), So the max LE Meta
subevent payload is 254, but hci_le_ev_table[] still uses
HCI_MAX_EVENT_SIZE (260) for it, which is imprecise.
Fix by defining HCI_MAX_LE_SUBEVT_PLEN (254) and using it instead.
Signed-off-by: Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx>
---
net/bluetooth/hci_event.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 03b805207ab0..1eacdd93c5b5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -7469,33 +7469,36 @@ static void hci_le_conn_rate_change_evt(struct hci_dev *hdev, void *data,
}
#define HCI_LE_EV(_op, _func, _len) \
HCI_LE_EV_VL(_op, _func, _len, _len)
#define HCI_LE_EV_STATUS(_op, _func) \
HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
+#define HCI_MAX_LE_SUBEVT_PLEN \
+ (HCI_MAX_EVENT_PLEN - sizeof(struct hci_ev_le_meta))
+
/* Entries in this table shall have their position according to the subevent
* opcode they handle so the use of the macros above is recommend since it does
* attempt to initialize at its proper index using Designated Initializers that
* way events without a callback function can be omitted.
*/
static const struct hci_le_ev {
void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
u16 min_len;
u16 max_len;
} hci_le_ev_table[U8_MAX + 1] = {
/* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
sizeof(struct hci_ev_le_conn_complete)),
/* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
sizeof(struct hci_ev_le_advertising_report),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
hci_le_conn_update_complete_evt,
sizeof(struct hci_ev_le_conn_update_complete)),
/* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
hci_le_remote_feat_complete_evt,
sizeof(struct hci_ev_le_remote_feat_complete)),
@@ -7508,33 +7511,33 @@ static const struct hci_le_ev {
sizeof(struct hci_ev_le_remote_conn_param_req)),
/* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
hci_le_enh_conn_complete_evt,
sizeof(struct hci_ev_le_enh_conn_complete)),
/* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
sizeof(struct hci_ev_le_direct_adv_report),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
sizeof(struct hci_ev_le_phy_update_complete)),
/* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
sizeof(struct hci_ev_le_ext_adv_report),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
hci_le_pa_sync_established_evt,
sizeof(struct hci_ev_le_pa_sync_established)),
/* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
hci_le_per_adv_report_evt,
sizeof(struct hci_ev_le_per_adv_report),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x10 = HCI_EV_LE_PA_SYNC_LOST] */
HCI_LE_EV(HCI_EV_LE_PA_SYNC_LOST, hci_le_pa_sync_lost_evt,
sizeof(struct hci_ev_le_pa_sync_lost)),
/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
sizeof(struct hci_evt_le_ext_adv_set_term)),
/* [0x18 = HCI_EVT_LE_PAST_RECEIVED] */
HCI_LE_EV(HCI_EV_LE_PAST_RECEIVED,
@@ -7545,38 +7548,38 @@ static const struct hci_le_ev {
sizeof(struct hci_evt_le_cis_established)),
/* [0x1a = HCI_EVT_LE_CIS_REQ] */
HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
sizeof(struct hci_evt_le_cis_req)),
/* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
hci_le_create_big_complete_evt,
sizeof(struct hci_evt_le_create_big_complete),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABLISHED] */
HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABLISHED,
hci_le_big_sync_established_evt,
sizeof(struct hci_evt_le_big_sync_established),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x1e = HCI_EVT_LE_BIG_SYNC_LOST] */
HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_LOST,
hci_le_big_sync_lost_evt,
sizeof(struct hci_evt_le_big_sync_lost),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
hci_le_big_info_adv_report_evt,
sizeof(struct hci_evt_le_big_info_adv_report),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x2b = HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE] */
HCI_LE_EV_VL(HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE,
hci_le_read_all_remote_features_evt,
sizeof(struct
hci_evt_le_read_all_remote_features_complete),
- HCI_MAX_EVENT_SIZE),
+ HCI_MAX_LE_SUBEVT_PLEN),
/* [0x37 = HCI_EVT_LE_CONN_RATE_CHANGE] */
HCI_LE_EV(HCI_EVT_LE_CONN_RATE_CHANGE, hci_le_conn_rate_change_evt,
sizeof(struct hci_evt_le_conn_rate_change)),
};
static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
struct sk_buff *skb, u16 *opcode, u8 *status,
hci_req_complete_t *req_complete,
--
2.34.1