linux-kernel - [PATCH] Bluetooth: Add filter for Qualcomm debug packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251003205837.10748-1-pascal.giard@etsmtl.ca>
Date: Fri,  3 Oct 2025 16:58:37 -0400
From: Pascal Giard <evilynux@...il.com>
To: marcel@...tmann.org,
	luiz.dentz@...il.com
Cc: linux-bluetooth@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Pascal Giard <pascal.giard@...mtl.ca>
Subject: [PATCH] Bluetooth: Add filter for Qualcomm debug packets

Some Qualcomm Bluetooth controllers, e.g., QCNFA765 send debug packets
as ACL frames with header 0x2EDC. The kernel misinterprets these as
malformed ACL packets, causing repeated errors:

  Bluetooth: hci0: ACL packet for unknown connection handle 3804

This can occur hundreds of times per minute, greatly cluttering logs.
On my computer, I am observing approximately 7 messages per second
when streaming audio to a speaker.

For Qualcomm controllers exchanging over UART, hci_qca.c already
filters out these debug packets. This patch is for controllers
not going through UART, but USB.

This patch filters these packets in btusb_recv_acl() before they reach
the HCI layer, redirecting them to hci_recv_diag().

Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765, kernel 6.16.9

Signed-off-by: Pascal Giard <pascal.giard@...mtl.ca>
---
 drivers/bluetooth/btusb.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 5e9ebf0c5312..900400646315 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -68,6 +68,9 @@ static struct usb_driver btusb_driver;
 #define BTUSB_ACTIONS_SEMI		BIT(27)
 #define BTUSB_BARROT			BIT(28)
 
+/* Qualcomm firmware debug packets header */
+#define QCA_DEBUG_HEADER	0x2EDC
+
 static const struct usb_device_id btusb_table[] = {
 	/* Generic Bluetooth USB device */
 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
@@ -1229,6 +1232,12 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 
 static int btusb_recv_acl(struct btusb_data *data, struct sk_buff *skb)
 {
+	/* Drop QCA firmware debug packets sent as ACL frames */
+	if (skb->len >= 2) {
+		if (get_unaligned_le16(skb->data) == QCA_DEBUG_HEADER)
+			return hci_recv_diag(data->hdev, skb);
+	}
+
 	/* Only queue ACL packet if intr_interval is set as it means
 	 * force_poll_sync has been enabled.
 	 */
-- 
2.51.0