[PATCH] Bluetooth: msft: Ignore vendor events shorter than the event prefix

[Adrian.Nguyen-Qualgo]

From: Adrian Nguyen <thenguyen1024@xxxxxxxxx>

msft_vendor_evt() is called for every HCI vendor event. When the
controller defines an MSFT event prefix, it pulls the prefix with
msft_skb_pull(), which logs "Malformed MSFT vendor event" when the
event is too short. A vendor event shorter than the prefix cannot be
an MSFT event, though, so it is reported as malformed for nothing.
Before commit 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor
Device Event") such events were dropped silently.

A WCN3990 logs this 20 times at every boot, while btqca downloads its
firmware and the controller answers each segment with a short QCA
vendor event.

Return quietly when the event is shorter than the prefix. Events that
match the prefix but are cut short still get reported.

Fixes: 3368aa357f3b ("Bluetooth: msft: Handle MSFT Monitor Device Event")
Assisted-by: LLM
Signed-off-by: Adrian Nguyen <thenguyen1024@xxxxxxxxx>
---

Notes:
    An LLM helped track down the cause and draft the fix and changelog;
    I reviewed the result and tested it.
    
    Tested on a Vsmart Active 1 (SDM660, WCN3990) with a 7.2-based kernel:
    the errors are gone at boot and hci0 comes up as before. Build-tested
    on bluetooth-next with W=1.

 net/bluetooth/msft.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 6f4b7c38a247..a3f07f35a1b3 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -1082,9 +1082,13 @@ void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 		return;
 
 	/* When the extension has defined an event prefix, check that it
-	 * matches, and otherwise just return.
+	 * matches, and otherwise just return. A vendor event shorter than the
+	 * prefix cannot be an MSFT event, so it is not malformed either.
 	 */
 	if (msft->evt_prefix_len > 0) {
+		if (skb->len < msft->evt_prefix_len)
+			return;
+
 		evt_prefix = msft_skb_pull(hdev, skb, 0, msft->evt_prefix_len);
 		if (!evt_prefix)
 			return;

base-commit: 964430c038967fd06643e866f68115664e1a1bd1
-- 
2.43.0