]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
Bluetooth: fix corruption in h4_recv_buf() after cleanup
authorCalvin Owens <calvin@wbinvd.org>
Thu, 23 Oct 2025 18:47:19 +0000 (11:47 -0700)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Fri, 24 Oct 2025 14:31:24 +0000 (10:31 -0400)
commitb489556a856d31f1eb73972150f371d2e4ce1de8
tree6b63f0badee0849a48cf6e0160b93130c846fb77
parent057b6ca5961203f16a2a02fb0592661a7a959a84
Bluetooth: fix corruption in h4_recv_buf() after cleanup

A different structure is stored in drvdata for the drivers which used
that duplicate function, but h4_recv_buf() assumes drvdata is always an
hci_uart structure.

Consequently, alignment and padding are now randomly corrupted for
btmtkuart, btnxpuart, and bpa10x in h4_recv_buf(), causing erratic
breakage.

Fix this by making the hci_uart structure the explicit argument to
h4_recv_buf(). Every caller already has a reference to hci_uart, and
already obtains the hci_hdev reference through it, so this actually
eliminates a redundant pointer indirection for all existing callers.

Fixes: 93f06f8f0daf ("Bluetooth: remove duplicate h4_recv_buf() in header")
Reported-by: Francesco Valla <francesco@valla.it>
Closes: https://lore.kernel.org/lkml/6837167.ZASKD2KPVS@fedora.fritz.box/
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
14 files changed:
drivers/bluetooth/bpa10x.c
drivers/bluetooth/btmtkuart.c
drivers/bluetooth/btnxpuart.c
drivers/bluetooth/hci_ag6xx.c
drivers/bluetooth/hci_aml.c
drivers/bluetooth/hci_ath.c
drivers/bluetooth/hci_bcm.c
drivers/bluetooth/hci_h4.c
drivers/bluetooth/hci_intel.c
drivers/bluetooth/hci_ll.c
drivers/bluetooth/hci_mrvl.c
drivers/bluetooth/hci_nokia.c
drivers/bluetooth/hci_qca.c
drivers/bluetooth/hci_uart.h