[PATCH 0/5] Bluetooth: harden packet and transport parsing

[Li Qiang]

This series hardens Bluetooth packet receive paths and the HCI UART
transmit path against malformed lengths and invalid callback return
values.

The affected code accesses protocol fields before confirming that the
complete headers are present, or trusts a received length while
appending to an skb. The HCI UART write worker also assumes that a tty
driver always returns a valid written-byte count. These assumptions can
lead to out-of-bounds accesses or invalid skb manipulation when data is
truncated or a lower-level driver reports an invalid result.

Validate packet headers and declared data ranges before dereferencing
or copying them. Reject tty write return values outside the skb length,
and reset the QCA memdump state when a collection is discarded.

The affected Bluetooth objects were built with the required Bluetooth
configuration dependencies enabled. The series also passes
git diff --check and checkpatch on the generated patches.

Li Qiang (5):
  Bluetooth: bfusb: validate received block boundaries
  Bluetooth: btmrvl: validate event packet lengths
  Bluetooth: hci_bcsp: validate received packet lengths
  Bluetooth: hci_ldisc: reject invalid tty write lengths
  Bluetooth: hci_qca: validate controller memdump frames

 drivers/bluetooth/bfusb.c       | 37 +++++++++++++++++++--
 drivers/bluetooth/btmrvl_main.c | 10 ++++++
 drivers/bluetooth/hci_bcsp.c    |  5 ++-
 drivers/bluetooth/hci_ldisc.c   |  6 ++++
 drivers/bluetooth/hci_qca.c     | 58 +++++++++++++++++++++++----------
 5 files changed, 95 insertions(+), 21 deletions(-)


base-commit: 123b934b63a0bb3f7aa016f640b992406acd4047
-- 
2.43.0