Re: [PATCH 0/5] Bluetooth: harden packet and transport parsing

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Thu, 16 Jul 2026 16:47:27 +0800 you wrote:
> This series hardens Bluetooth packet receive paths and the HCI UART
> transmit path against malformed lengths and invalid callback return
> values.
> 
> The affected code accesses protocol fields before confirming that the
> complete headers are present, or trusts a received length while
> appending to an skb. The HCI UART write worker also assumes that a tty
> driver always returns a valid written-byte count. These assumptions can
> lead to out-of-bounds accesses or invalid skb manipulation when data is
> truncated or a lower-level driver reports an invalid result.
> 
> [...]

Here is the summary with links:
  - [1/5] Bluetooth: bfusb: validate received block boundaries
    https://git.kernel.org/bluetooth/bluetooth-next/c/b94bab6f1dd9
  - [2/5] Bluetooth: btmrvl: validate event packet lengths
    https://git.kernel.org/bluetooth/bluetooth-next/c/75e574f6a212
  - [3/5] Bluetooth: hci_bcsp: validate received packet lengths
    https://git.kernel.org/bluetooth/bluetooth-next/c/a4c72c8c7cef
  - [4/5] Bluetooth: hci_ldisc: reject invalid tty write lengths
    https://git.kernel.org/bluetooth/bluetooth-next/c/5afe69c190c4
  - [5/5] Bluetooth: hci_qca: validate controller memdump frames
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html