From 233c3f2ce017fb4a6ea0a4a243c0b984e45ffa1e Mon Sep 17 00:00:00 2001 From: Tedd Ho-Jeong An Date: Wed, 4 Nov 2020 21:09:48 -0800 Subject: [PATCH 1/6] workflow: Add workflow files for ci This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An --- .github/workflows/ci.yml | 25 ++++++++++++++++++++++ .github/workflows/sync.yml | 43 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/sync.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000000000..3a2c45c37553c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,25 @@ +name: CI + +on: [pull_request] + +jobs: + ci: + runs-on: ubuntu-latest + name: CI for Pull Request + steps: + - name: Checkout the source code + uses: actions/checkout@v3 + with: + path: src/src + + - name: CI + uses: tedd-an/bzcafe@main + with: + task: ci + base_folder: src + space: kernel + github_token: ${{ secrets.GITHUB_TOKEN }} + email_token: ${{ secrets.EMAIL_TOKEN }} + patchwork_token: ${{ secrets.PATCHWORK_TOKEN }} + patchwork_user: ${{ secrets.PATCHWORK_USER }} + diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml new file mode 100644 index 0000000000000..3883d55a23267 --- /dev/null +++ b/.github/workflows/sync.yml @@ -0,0 +1,43 @@ +name: Sync + +on: + schedule: + - cron: "*/30 * * * *" + +jobs: + sync_repo: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + ref: master + + - name: Sync Repo + uses: tedd-an/bzcafe@main + with: + task: sync + upstream_repo: 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git' + github_token: ${{ secrets.GITHUB_TOKEN }} + + - name: Cleanup PR + uses: tedd-an/bzcafe@main + with: + task: cleanup + github_token: ${{ secrets.ACTION_TOKEN }} + + sync_patchwork: + needs: sync_repo + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: Sync Patchwork + uses: tedd-an/bzcafe@main + with: + task: patchwork + space: kernel + github_token: ${{ secrets.ACTION_TOKEN }} + email_token: ${{ secrets.EMAIL_TOKEN }} + patchwork_token: ${{ secrets.PATCHWORK_TOKEN }} + patchwork_user: ${{ secrets.PATCHWORK_USER }} + From e8329bdf76f9a99c012ff40a4fa246f2801e25a6 Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Thu, 9 Apr 2026 12:57:28 -0400 Subject: [PATCH 2/6] workflows: Make use bluez/action-ci action This replaces the bzcafe action with bluez/action-ci so we can maintain everything in the github bluez organization Signed-off-by: Luiz Augusto von Dentz --- .github/workflows/ci.yml | 2 +- .github/workflows/sync.yml | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3a2c45c37553c..58bd27096c3cf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: path: src/src - name: CI - uses: tedd-an/bzcafe@main + uses: bluez/action-ci@main with: task: ci base_folder: src diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml index 3883d55a23267..6fb956309caa0 100644 --- a/.github/workflows/sync.yml +++ b/.github/workflows/sync.yml @@ -13,14 +13,14 @@ jobs: ref: master - name: Sync Repo - uses: tedd-an/bzcafe@main + uses: bluez/action-ci@main with: task: sync upstream_repo: 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git' github_token: ${{ secrets.GITHUB_TOKEN }} - name: Cleanup PR - uses: tedd-an/bzcafe@main + uses: bluez/action-ci@main with: task: cleanup github_token: ${{ secrets.ACTION_TOKEN }} @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v3 - name: Sync Patchwork - uses: tedd-an/bzcafe@main + uses: bluez/action-ci@main with: task: patchwork space: kernel @@ -40,4 +40,3 @@ jobs: email_token: ${{ secrets.EMAIL_TOKEN }} patchwork_token: ${{ secrets.PATCHWORK_TOKEN }} patchwork_user: ${{ secrets.PATCHWORK_USER }} - From 21607feeca15674ffe82e26e09d885719eac6449 Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Thu, 9 Apr 2026 13:18:58 -0400 Subject: [PATCH 3/6] workflow/sync: Attempt to sync every 5 minutes This attempts to sync every 5 minutes instead of 30. Signed-off-by: Luiz Augusto von Dentz --- .github/workflows/sync.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml index 6fb956309caa0..92164bde28cef 100644 --- a/.github/workflows/sync.yml +++ b/.github/workflows/sync.yml @@ -2,7 +2,7 @@ name: Sync on: schedule: - - cron: "*/30 * * * *" + - cron: "*/5 * * * *" jobs: sync_repo: From cc49aeea99315dc27e2ec23331084d3dfcf529f3 Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Thu, 9 Apr 2026 15:21:22 -0400 Subject: [PATCH 4/6] workflow/sync: Set workflow to use worflow branch bluez/action-ci uses master as default branch for workflow which is incorrect for kernel Signed-off-by: Luiz Augusto von Dentz --- .github/workflows/sync.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml index 92164bde28cef..5e95af92ab1ab 100644 --- a/.github/workflows/sync.yml +++ b/.github/workflows/sync.yml @@ -16,6 +16,7 @@ jobs: uses: bluez/action-ci@main with: task: sync + workflow: workflow upstream_repo: 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git' github_token: ${{ secrets.GITHUB_TOKEN }} @@ -35,6 +36,7 @@ jobs: uses: bluez/action-ci@main with: task: patchwork + workflow: workflow space: kernel github_token: ${{ secrets.ACTION_TOKEN }} email_token: ${{ secrets.EMAIL_TOKEN }} From b22743727efce194435bb91a3a45cc67cca238bf Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Mon, 13 Apr 2026 16:41:33 -0400 Subject: [PATCH 5/6] workflow/ci: Add checks:write permission and explicit reopened trigger The CI action now creates individual GitHub Check Runs per test, which requires 'checks: write' permission on the GITHUB_TOKEN. Also make the pull_request trigger types explicit to include 'reopened', allowing CI to be retriggered by closing and reopening a PR. --- .github/workflows/ci.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58bd27096c3cf..60d318f805ff1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,12 @@ name: CI -on: [pull_request] +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + checks: write + pull-requests: write jobs: ci: From 1b725bd7786c66ce26365c6c3af22f8c49c16989 Mon Sep 17 00:00:00 2001 From: Quan Sun <2022090917019@std.uestc.edu.cn> Date: Sun, 17 May 2026 14:01:42 +0800 Subject: [PATCH 6/6] Bluetooth: btintel: Use skb_pull_data return for bounds check The length check at the top of btintel_print_fseq_info() verifies the skb has at least 66 bytes (sizeof(u32) * 16 + 2), but the function actually consumes 74 bytes (2 * 1 + 18 * 4). When firmware returns a packet of exactly 66 bytes, the last two skb_pull_data() calls return NULL, which is passed directly to get_unaligned_le32(), resulting in a NULL pointer dereference. Remove the insufficient length check and instead validate every skb_pull_data() return value, branching to a malformed label that logs the error and frees the skb. Fixes: a7ba218a44aa ("Bluetooth: btintel: Print Firmware Sequencer information") Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn> --- drivers/bluetooth/btintel.c | 106 +++++++++++++++++++++++++++--------- 1 file changed, 79 insertions(+), 27 deletions(-) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index 5e9cac090bd8f..0c42ee53fe2ea 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -3358,14 +3358,9 @@ void btintel_print_fseq_info(struct hci_dev *hdev) return; } - if (skb->len < (sizeof(u32) * 16 + 2)) { - bt_dev_dbg(hdev, "Malformed packet of length %u received", - skb->len); - kfree_skb(skb); - return; - } - p = skb_pull_data(skb, 1); + if (!p) + goto malformed; if (*p) { bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); kfree_skb(skb); @@ -3373,6 +3368,8 @@ void btintel_print_fseq_info(struct hci_dev *hdev) } p = skb_pull_data(skb, 1); + if (!p) + goto malformed; switch (*p) { case 0: str = "Success"; @@ -3396,65 +3393,120 @@ void btintel_print_fseq_info(struct hci_dev *hdev) bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); - p = skb->data; - skb_pull_data(skb, 4); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], p[2], p[3]); - p = skb->data; - skb_pull_data(skb, 4); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], p[2], p[3]); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); - val = get_unaligned_le32(skb_pull_data(skb, 4)); + p = skb_pull_data(skb, 4); + if (!p) + goto malformed; + val = get_unaligned_le32(p); bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); kfree_skb(skb); + return; + +malformed: + bt_dev_dbg(hdev, "Malformed packet received"); + kfree_skb(skb); } EXPORT_SYMBOL_GPL(btintel_print_fseq_info);