linux-kernel - Re: [PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a91cf69c-e9d9-40b6-9bba-0308855c3014@molgen.mpg.de>
Date: Tue, 7 Oct 2025 18:16:19 +0200
From: Paul Menzel <pmenzel@...gen.mpg.de>
To: Pascal Giard <evilynux@...il.com>
Cc: marcel@...tmann.org, luiz.dentz@...il.com,
 linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org,
 Pascal Giard <pascal.giard@...mtl.ca>
Subject: Re: [PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855
 debug packets

Dear Pascal,


Thank you for your patch.

Am 07.10.25 um 17:33 schrieb Pascal Giard:
> Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855
> chip, send debug packets as ACL frames with header 0x2EDC.
> The kernel misinterprets these as malformed ACL packets, causing
> repeated errors:
> 
>    Bluetooth: hci0: ACL packet for unknown connection handle 3804
> 
> This can occur hundreds of times per minute, greatly cluttering logs.
> On my computer, I am observing approximately 7 messages per second
> when streaming audio to a speaker.
> 
> For Qualcomm controllers exchanging over UART, hci_qca.c already
> filters out these debug packets. This patch is for controllers
> not going through UART, but USB.
> 
> This patch uses the classify_pkt_type callback to reclassify the
> packets with handle 0x2EDC as HCI_DIAG_PKT before they reach the
> HCI layer. This change is only applied to Qualcomm devices marked
> as BTUSB_QCA_WCN6855.
> 
> Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765 (0489:E0D0)
> Signed-off-by: Pascal Giard <pascal.giard@...mtl.ca>
> ---
> Changes in v2:
> - Address reviewer feedback about 0x2EDC being a valid HCI handle
> - Use classify_pkt_type callback instead of filtering in recv_acl
> - Only apply to devices with BTUSB_QCA_WCN6855 quirk

Outstanding commit message!

> ---
>   drivers/bluetooth/btusb.c | 19 +++++++++++++++++++
>   1 file changed, 19 insertions(+)
> 
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 5e9ebf0c5312..256179ace853 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -1131,6 +1131,24 @@ static void btusb_qca_reset(struct hci_dev *hdev)
>   	btusb_reset(hdev);
>   }
>   
> +static u8 btusb_classify_qca_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
> +{
> +	/* Some Qualcomm controllers, e.g., QCNFA765 with WCN6855 chip, send debug
> +	 * packets as ACL frames with connection handle 0x2EDC. These are not real
> +	 * ACL packets and should be reclassified as HCI_DIAG_PKT to prevent
> +	 * "ACL packet for unknown connection handle 3804" errors.
> +	 */
> +	if (skb->len >= 2) {
> +		u16 handle = get_unaligned_le16(skb->data);
> +
> +		if (handle == 0x2EDC)
> +			return HCI_DIAG_PKT;
> +	}
> +
> +	/* Use default packet type for other packets */
> +	return hci_skb_pkt_type(skb);
> +}
> +
>   static inline void btusb_free_frags(struct btusb_data *data)
>   {
>   	unsigned long flags;
> @@ -4201,6 +4219,7 @@ static int btusb_probe(struct usb_interface *intf,
>   		data->recv_acl = btusb_recv_acl_qca;
>   		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
>   		data->setup_on_usb = btusb_setup_qca;
> +		hdev->classify_pkt_type = btusb_classify_qca_pkt_type;
>   		hdev->shutdown = btusb_shutdown_qca;
>   		hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
>   		hdev->reset = btusb_qca_reset;

Reviewed-by: Paul Menzel <pmenzel@...gen.mpg.de>


Kind regards,

Paul