From 0e9790efba504976f1cd5011c62fe9437f6a6ff7 Mon Sep 17 00:00:00 2001 From: Tedd Ho-Jeong An Date: Wed, 4 Nov 2020 21:09:48 -0800 Subject: [PATCH 1/2] workflow: Add workflow files for ci This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An --- .github/workflows/ci.yml | 25 ++++++++++++++++++++++ .github/workflows/sync.yml | 43 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/sync.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000000000..3a2c45c37553c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,25 @@ +name: CI + +on: [pull_request] + +jobs: + ci: + runs-on: ubuntu-latest + name: CI for Pull Request + steps: + - name: Checkout the source code + uses: actions/checkout@v3 + with: + path: src/src + + - name: CI + uses: tedd-an/bzcafe@main + with: + task: ci + base_folder: src + space: kernel + github_token: ${{ secrets.GITHUB_TOKEN }} + email_token: ${{ secrets.EMAIL_TOKEN }} + patchwork_token: ${{ secrets.PATCHWORK_TOKEN }} + patchwork_user: ${{ secrets.PATCHWORK_USER }} + diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml new file mode 100644 index 0000000000000..3883d55a23267 --- /dev/null +++ b/.github/workflows/sync.yml @@ -0,0 +1,43 @@ +name: Sync + +on: + schedule: + - cron: "*/30 * * * *" + +jobs: + sync_repo: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + ref: master + + - name: Sync Repo + uses: tedd-an/bzcafe@main + with: + task: sync + upstream_repo: 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git' + github_token: ${{ secrets.GITHUB_TOKEN }} + + - name: Cleanup PR + uses: tedd-an/bzcafe@main + with: + task: cleanup + github_token: ${{ secrets.ACTION_TOKEN }} + + sync_patchwork: + needs: sync_repo + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: Sync Patchwork + uses: tedd-an/bzcafe@main + with: + task: patchwork + space: kernel + github_token: ${{ secrets.ACTION_TOKEN }} + email_token: ${{ secrets.EMAIL_TOKEN }} + patchwork_token: ${{ secrets.PATCHWORK_TOKEN }} + patchwork_user: ${{ secrets.PATCHWORK_USER }} + From 6ca94b3f23d04f06f43750d7f1a131ed0c432272 Mon Sep 17 00:00:00 2001 From: Nathan Rebello Date: Mon, 30 Mar 2026 18:10:15 -0400 Subject: [PATCH 2/2] Bluetooth: ISO: fix NULL deref in iso_recv() ISO_END handling The ISO_CONT case in iso_recv() properly checks for unexpected continuation frames and oversized fragments before accessing conn->rx_skb. The ISO_END case lacks both checks. When an ISO_END packet arrives without a preceding ISO_START: - conn->rx_skb is NULL (never allocated) - skb_put(conn->rx_skb, ...) dereferences NULL -> kernel crash When an ISO_END fragment length does not exactly match the remaining expected length: - the reassembly is malformed and must be rejected KASAN confirmed the NULL-deref on kernel 7.0.0-rc5 via VHCI: general protection fault, probably for non-canonical address 0xdffffc0000000018 KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] CPU: 0 UID: 0 PID: 72 Comm: kworker/u9:0 Not tainted 7.0.0-rc5 Workqueue: hci0 hci_rx_work RIP: 0010:skb_put+0x27/0x1a0 Call Trace: iso_recv+0x5e0/0xee0 hci_rx_work+0x226/0x730 process_one_work+0x633/0x1060 worker_thread+0x45b/0xd10 kthread+0x2c6/0x3b0 ret_from_fork+0x38d/0x5c0 Kernel panic - not syncing: Fatal exception Fix by adding validation to the ISO_END case: reject end frames when no rx_skb reassembly buffer exists, and reject end fragments whose length does not exactly complete the expected reassembly. Fixes: ccf74f2390d6 ("Bluetooth: Add ISO Socket") Cc: stable@vger.kernel.org Signed-off-by: Nathan Rebello --- net/bluetooth/iso.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index be145e2736b78..7c57b1d224436 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -2587,6 +2587,20 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags) break; case ISO_END: + if (!conn->rx_skb) { + BT_ERR("Unexpected end frame (len %d)", skb->len); + goto drop; + } + + if (skb->len != conn->rx_len) { + BT_ERR("End fragment length mismatch (len %d, expected %d)", + skb->len, conn->rx_len); + kfree_skb(conn->rx_skb); + conn->rx_skb = NULL; + conn->rx_len = 0; + goto drop; + } + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), skb->len); conn->rx_len -= skb->len;