Greg Kroah-HartmanandLuiz Augusto von Dentz cac43d360c Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() ...

If btusb_qca_send_vendor_req() gets a "short" read from a device, it
will accidentally treat that as a "real" read and populate the returned
value with some unknown and probably totally invalid data.

Fix this logic error up by calling usb_control_msg_recv() which
guarantees a "full" read happens, and then simplify the error checking
for when btusb_qca_send_vendor_req() is called.

Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

2026-07-28 16:13:48 -04:00

..

ath3k.c

…

bcm203x.c

…

bfusb.c

…

bpa10x.c

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

2026-07-06 10:46:58 -04:00

btbcm.c

Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth

2026-04-10 10:22:21 -04:00

btbcm.h

…

btintel_pcie.c

Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()

2026-07-06 10:46:58 -04:00

btintel_pcie.h

Bluetooth: btintel_pcie: Separate coredump work from RX work

2026-06-11 14:24:42 -04:00

btintel.c

Bluetooth: btintel: Validate length before parsing diagnostics TLV

2026-07-28 16:13:12 -04:00

btintel.h

Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant

2026-06-11 14:24:41 -04:00

btmrvl_debugfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btmrvl_drv.h

…

btmrvl_main.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btmrvl_sdio.c

…

btmrvl_sdio.h

…

btmtk.c

Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()

2026-07-28 16:13:48 -04:00

btmtk.h

Bluetooth: btmtk: add event filter to filter specific event

2026-06-11 14:24:37 -04:00

btmtksdio.c

Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()

2026-06-11 14:24:42 -04:00

btmtkuart.c

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

btnxpuart.c

Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

2026-07-06 10:46:57 -04:00

btqca.c

Bluetooth: qca: fix NVM tag length underflow in TLV parser

2026-07-13 10:02:57 -04:00

btqca.h

…

btqcomsmd.c

…

btrsi.c

Bluetooth: Add SPDX id lines to some source files

2026-06-11 14:24:41 -04:00

btrtl.c

Bluetooth: btrtl: validate firmware patch bounds

2026-07-13 10:08:06 -04:00

btrtl.h

…

btsdio.c

…

btusb.c

Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()

2026-07-28 16:13:48 -04:00

hci_ag6xx.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_aml.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_ath.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_bcm4377.c

Bluetooth: hci_bcm4377: Use generic power management

2026-01-29 13:22:42 -05:00

hci_bcm.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_bcsp.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_h4.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_h5.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

hci_intel.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_ldisc.c

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

2026-07-06 09:49:59 -04:00

hci_ll.c

Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x

2026-04-13 09:19:42 -04:00

hci_mrvl.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_nokia.c

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

hci_qca.c

Bluetooth: hci_qca: Clear memdump state on invalid dump size

2026-07-13 10:09:52 -04:00

hci_serdev.c

…

hci_uart.h

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

hci_vhci.c

Bluetooth: vhci: validate devcoredump state before side effects

2026-06-11 14:24:41 -04:00

Kconfig

bluetooth: remove all PCMCIA drivers

2026-06-11 14:24:38 -04:00

Makefile

bluetooth: remove all PCMCIA drivers

2026-06-11 14:24:38 -04:00

virtio_bt.c

Bluetooth: virtio_bt: validate rx pkt_type header length

2026-05-06 16:22:33 -04:00