Zijun Hu 9a4fa3cddc Bluetooth: hci_event: Use 255 as max event payload length in hci_ev_table[] ... hci_event_func() validates skb->len against ev->max_len from the entry in hci_ev_table[]. By then, the header has already been stripped by skb_pull(). So the max event payload is 255, but hci_ev_table[] still uses HCI_MAX_EVENT_SIZE (260) for it, which is imprecise. Fix by introducing HCI_MAX_EVENT_PLEN (255) and using it instead. Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-08-07 15:40:27 -04:00
..
bluetooth.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
coredump.h	Bluetooth: coredump: Expose header size and end marker to drivers	2026-08-07 15:40:26 -04:00
hci_core.h	Bluetooth: hci_event: Introduce handle_ev_vendor() for HCI_EV_VENDOR	2026-08-07 15:40:27 -04:00
hci_drv.h	Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le()	2025-09-27 11:37:00 -04:00
hci_mon.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
hci_sock.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
hci_sync.h	Bluetooth: Add MGMT Load Connection Subrate command	2026-08-07 15:38:32 -04:00
hci.h	Bluetooth: hci_event: Use 255 as max event payload length in hci_ev_table[]	2026-08-07 15:40:27 -04:00
iso.h	Bluetooth: ISO: Add broadcast support	2022-07-22 17:14:13 -07:00
l2cap.h	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()	2026-07-06 10:46:58 -04:00
mgmt.h	Bluetooth: Add MGMT Load Connection Subrate command	2026-08-07 15:38:32 -04:00
rfcomm.h	Bluetooth: RFCOMM: Fix session UAF in set_termios	2026-07-20 17:41:07 -04:00
sco.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00