kernel/git/next/linux-next.git/net/bluetooth/hci_codec.c, branch stable

Bluetooth: hci: validate codec capability element length

2026-06-11T18:24:41+00:00

Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses. Fixes: 8961987f3f5f ("Bluetooth: Enumerate local supported codec and cache details") Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius Signed-off-by: Luiz Augusto von Dentz

Bluetooth: Fix support for Read Local Supported Codecs V2

2022-12-02T21:09:31+00:00

Handling of Read Local Supported Codecs was broken during the HCI serialization design change patches. Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages") Signed-off-by: Chethan T N Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz

Bluetooth: Read codec capabilities only if supported

2021-10-07T15:57:22+00:00

Read codec capabilities only if HCI_READ_LOCAL_CODEC_CAPABILITIES command is supported. If capablities are not supported, then cache codec data without caps. Signed-off-by: Kiran K Signed-off-by: Marcel Holtmann

Bluetooth: Add support for Read Local Supported Codecs V2

2021-09-07T21:09:18+00:00

Use V2 version of read local supported command is controller supports snoop: > HCI Event: Command Complete (0x0e) plen 20 Read Local Supported Codecs V2 (0x04|0x000d) ncmd 1 Status: Success (0x00) Number of supported codecs: 7 Codec: u-law log (0x00) Logical Transport Type: 0x02 Codec supported over BR/EDR SCO and eSCO Codec: A-law log (0x01) Logical Transport Type: 0x02 Codec supported over BR/EDR SCO and eSCO Codec: CVSD (0x02) Logical Transport Type: 0x02 Codec supported over BR/EDR SCO and eSCO Codec: Transparent (0x03) Logical Transport Type: 0x02 Codec supported over BR/EDR SCO and eSCO Codec: Linear PCM (0x04) Logical Transport Type: 0x02 Codec supported over BR/EDR SCO and eSCO Codec: Reserved (0x08) Logical Transport Type: 0x03 Codec supported over BR/EDR ACL Codec supported over BR/EDR SCO and eSCO Codec: mSBC (0x05) Logical Transport Type: 0x03 Codec supported over BR/EDR ACL Codec supported over BR/EDR SCO and eSCO Number of vendor codecs: 0 ...... < HCI Command: Read Local Suppor.. (0x04|0x000e) plen 7 Codec: mSBC (0x05) Logical Transport Type: 0x00 Direction: Input (Host to Controller) (0x00) > HCI Event: Command Complete (0x0e) plen 12 Read Local Supported Codec Capabilities (0x04|0x000e) ncmd 1 Status: Success (0x00) Number of codec capabilities: 1 Capabilities #0: 00 00 11 15 02 33 Signed-off-by: Kiran K Signed-off-by: Chethan T N Signed-off-by: Srivatsa Ravishankar Signed-off-by: Luiz Augusto von Dentz

Bluetooth: Enumerate local supported codec and cache details

2021-09-07T21:09:18+00:00

Move reading of supported local codecs into a separate init function, query codecs capabilities and cache the data Signed-off-by: Kiran K Signed-off-by: Chethan T N Signed-off-by: Srivatsa Ravishankar Signed-off-by: Luiz Augusto von Dentz