RE: [v1] Bluetooth: btusb: Fix UAF of btusb_data by rx_work
From: <hidden>
Date: 2026-08-31 18:56:41
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1154686 ---Test result--- Test Summary: CheckPatch PASS 1.34 seconds VerifyFixes PASS 0.11 seconds VerifySignedoff PASS 0.46 seconds GitLint FAIL 0.55 seconds SubjectPrefix PASS 0.20 seconds BuildKernel FAIL 23.36 seconds CheckAllWarning FAIL 25.43 seconds CheckSparse FAIL 24.40 seconds BuildKernel32 FAIL 22.01 seconds CheckKernelLLVM SKIP 0.00 seconds TestRunnerSetup FAIL 445.05 seconds IncrementalBuild FAIL 25.56 seconds Details ############################## Test: GitLint - FAIL Desc: Run gitlint Output: [v1] Bluetooth: btusb: Fix UAF of btusb_data by rx_work 13: B3 Line contains hard tab characters (\t): " while ((skb = skb_dequeue(&data->acl_q)))" 14: B3 Line contains hard tab characters (\t): " data->recv_acl(data->hdev, skb);" ############################## Test: BuildKernel - FAIL Desc: Build Kernel for Bluetooth Output: drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 ############################## Test: CheckAllWarning - FAIL Desc: Run linux kernel with all warning enabled Output: drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 ############################## Test: CheckSparse - FAIL Desc: Run sparse tool with linux kernel Output: /github/workspace/src/src/Makefile:1283: C=1 specified, but sparse is not available or not up to date /github/workspace/src/src/Makefile:1283: C=1 specified, but sparse is not available or not up to date drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 ############################## Test: BuildKernel32 - FAIL Desc: Build 32bit Kernel for Bluetooth Output: drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 ############################## Test: CheckKernelLLVM - SKIP Desc: Build kernel with LLVM + context analysis Output: Clang not found ############################## Test: TestRunnerSetup - FAIL Desc: Setup kernel and bluez for test-runner Output: Kernel: drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 ############################## Test: IncrementalBuild - FAIL Desc: Incremental build with the patches in the series Output: drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 [v3,2/2] Bluetooth: btusb: Add support for Bulk Serialization Mode drivers/bluetooth/btusb.c: In function ‘btusb_recv_h4’: drivers/bluetooth/btusb.c:1385:17: error: implicit declaration of function ‘h4_recv_skb’; did you mean ‘h4_recv_buf’? [-Werror=implicit-function-declaration] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^~~~~~~~~~~ | h4_recv_buf drivers/bluetooth/btusb.c:1385:15: warning: assignment to ‘struct sk_buff *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 1385 | data->rx_skb = h4_recv_skb(data->hdev, NULL, NULL, data->rx_skb, buffer, | ^ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:289: drivers/bluetooth/btusb.o] Error 1 make[3]: *** [scripts/Makefile.build:549: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:549: drivers] Error 2 make[1]: *** [/github/workspace/src/src/Makefile:2187: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 https://github.com/bluez/bluetooth-next/pull/675 --- Regards, Linux Bluetooth