diff options
| author | Sai Teja Aluvala <aluvala.sai.teja@intel.com> | 2026-09-11 17:22:22 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-09-15 14:55:27 -0400 |
| commit | 2ea5a87a5a7ae58cb2662b8a7d06f209383e1765 (patch) | |
| tree | a638c3e1b1c57dee1188e045a8cdc77d4fde9277 | |
| parent | 7b60ee5f46f2ee329de661f7c68b6818d8136220 (diff) | |
| download | linux-next-2ea5a87a5a7ae58cb2662b8a7d06f209383e1765.tar.gz linux-next-2ea5a87a5a7ae58cb2662b8a7d06f209383e1765.zip | |
Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the
FRBD array access, allowing frbd_index == rxq->count to pass through
and index one element past the end of the array. Change the check to
>= rxq->count so every out-of-range index is rejected.
This issue was reported by Claude Mythos.
Fixes: c2b636b3f788 (Bluetooth: btintel_pcie: Add support for PCIe transport)
Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
| -rw-r--r-- | drivers/bluetooth/btintel_pcie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c index 405b23e21473..6e6e2b19815c 100644 --- a/drivers/bluetooth/btintel_pcie.c +++ b/drivers/bluetooth/btintel_pcie.c @@ -508,7 +508,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data) frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM]; - if (frbd_index > rxq->count) + if (frbd_index >= rxq->count) return -ERANGE; /* Prepare for RX submit. It updates the FRBD with the address of DMA |