[PATCH v2 0/2] Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[PATCH v2 0/2] Bluetooth: btnxpuart: Simplify ACL handling and fix skb leak

[Zijun Hu]

This series simplifies ACL handle extraction in btnxpuart and fixes
an skb leak when devcoredump support is disabled, — all simple.

---
Changes in v2:
- Add a minor ACL handle-extraction simplification in btnxpuart.
- Fix the skb leak in btnxpuart when devcoredump support is disabled.
- Link to v1: https://patch.msgid.link/20260913-misc_fix-v1-0-558c1e4028b9@oss.qualcomm.com

---
Zijun Hu (2):
      Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()
      Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

 drivers/bluetooth/btnxpuart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
---
base-commit: 0186e4e1e5c26a21058a263cccd878fbf894677e
change-id: 20260913-misc_fix-6f6f518fe6b5

Best regards,
--  
Zijun Hu <zijun.hu@oss.qualcomm.com>

[PATCH v2 1/2] Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()

[Zijun Hu]

Simplify nxp_recv_acl_pkt() by using hci_acl_handle() instead of:

__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
... (handle & 0x0FFF) ...

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/btnxpuart.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index f2bbe6e462aa..69e897444112 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1400,20 +1400,18 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
 
 free_skb:
 	kfree_skb(skb);
 	return 0;
 }
 
 static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
-
 	/* FW dump chunks are ACL packets with conn handle 0xfff */
-	if ((handle & 0x0FFF) == 0xFFF)
+	if (hci_acl_handle(skb) == 0xFFF)
 		return nxp_process_fw_dump(hdev, skb);
 	else
 		return hci_recv_frame(hdev, skb);
 }
 
 static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 {
 	union nxp_set_bd_addr_payload pcmd;

-- 
2.34.1

[PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Zijun Hu]

When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
without freeing its skb argument. This leaks the cloned skb and also
prevents nxp_set_ind_reset() from being called to perform recovery.

Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
CONFIG_DEV_COREDUMP.

Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/bluetooth/btnxpuart.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index 69e897444112..a0b64fdcbcc1 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
 		err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
 		if (err < 0)
 			goto free_skb;
 
 		schedule_delayed_work(&hdev->dump.dump_timeout,
 				      msecs_to_jiffies(20000));
 	}
 
+#ifdef CONFIG_DEV_COREDUMP
 	err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
 	if (err < 0)
 		goto free_skb;
+#endif
 
 	if (buf_len == 0) {
 		bt_dev_warn(hdev, "==== FW dump complete ===");
 		hci_devcd_complete(hdev);
 		nxp_set_ind_reset(hdev, NULL);
 	}
 
 free_skb:

-- 
2.34.1

[PATCH v2 1/2] Bluetooth: btnxpuart: Simplify nxp_recv_acl_pkt() by hci_acl_handle()

[Neeraj Kale]

Hi Zijun,

Thank you for the patch. The fix looks good to me.

Reviewed-by: Neeraj Sanjay Kale neeraj.sanjaykale@nxp.com

Thanks,
Neeraj

> Simplify nxp_recv_acl_pkt() by using hci_acl_handle() instead of:
>
> __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
> ... (handle & 0x0FFF) ...
>
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index f2bbe6e462aa..69e897444112 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1400,20 +1400,18 @@ static int nxp_process_fw_dump(struct hci_dev
> *hdev, struct sk_buff *skb)
>
>  free_skb:
>         kfree_skb(skb);
>         return 0;
>  }
>
>  static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)  {
> -       __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
> -
>         /* FW dump chunks are ACL packets with conn handle 0xfff */
> -       if ((handle & 0x0FFF) == 0xFFF)
> +       if (hci_acl_handle(skb) == 0xFFF)
>                 return nxp_process_fw_dump(hdev, skb);
>         else
>                 return hci_recv_frame(hdev, skb);  }
>
>  static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)  {
>         union nxp_set_bd_addr_payload pcmd;
>
> --
> 2.34.1


NXP Confidential

[PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Neeraj Kale]

Hi Zijun,

Thank you for the patch. The fix looks good to me.

Reviewed-by: Neeraj Sanjay Kale neeraj.sanjaykale@nxp.com

Thanks,
Neeraj

> When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -
> EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and
> also prevents nxp_set_ind_reset() from being called to perform recovery.
>
> Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
> CONFIG_DEV_COREDUMP.
>
> Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump
> feature")
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 69e897444112..a0b64fdcbcc1 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev
> *hdev, struct sk_buff *skb)
>                 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
>                 if (err < 0)
>                         goto free_skb;
>
>                 schedule_delayed_work(&hdev->dump.dump_timeout,
>                                       msecs_to_jiffies(20000));
>         }
>
> +#ifdef CONFIG_DEV_COREDUMP
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
> +#endif
>
>         if (buf_len == 0) {
>                 bt_dev_warn(hdev, "==== FW dump complete ===");
>                 hci_devcd_complete(hdev);
>                 nxp_set_ind_reset(hdev, NULL);
>         }
>
>  free_skb:
>
> --
> 2.34.1


NXP Confidential

Re: [PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Luiz Augusto von Dentz]

Hi Zijun,

On Tue, Sep 15, 2026 at 1:41 AM Zijun Hu <zijun.hu@oss.qualcomm.com> wrote:
>
> When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
> without freeing its skb argument. This leaks the cloned skb and also
> prevents nxp_set_ind_reset() from being called to perform recovery.
>
> Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
> CONFIG_DEV_COREDUMP.
>
> Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
> Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 69e897444112..a0b64fdcbcc1 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
>                 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
>                 if (err < 0)
>                         goto free_skb;
>
>                 schedule_delayed_work(&hdev->dump.dump_timeout,
>                                       msecs_to_jiffies(20000));
>         }
>
> +#ifdef CONFIG_DEV_COREDUMP
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
> +#endif

I guess IS_ENABLED is preferable here so the code is still compiled in
leaving it up to the compiler to remove it in case it is considered
dead code.

>
>         if (buf_len == 0) {
>                 bt_dev_warn(hdev, "==== FW dump complete ===");
>                 hci_devcd_complete(hdev);
>                 nxp_set_ind_reset(hdev, NULL);
>         }
>
>  free_skb:
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz