[PATCH v1] Bluetooth: btintel_pcie: validate TX skb length in send_sync

[PATCH v1] Bluetooth: btintel_pcie: validate TX skb length in send_sync

[Chandrashekar Devegowda]

btintel_pcie_prepare_tx() copies skb->len bytes into a fixed
BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy.
Oversized packets are currently rejected only in
btintel_pcie_send_frame(); any future caller of
btintel_pcie_send_sync() would silently overflow the DMA buffer.

Add the bounds check in btintel_pcie_send_sync() itself, right
before skb_push() and the DMA copy.

Assisted-by: Copilot:claude-sonnet-5 code-review code-generation
Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup* function to download firmware")
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 04f5b0273977..68d8e378ce7e 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -536,6 +536,12 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data,
 	if (tfd_index > txq->count)
 		return -ERANGE;
 
+	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN) {
+		bt_dev_err(hdev, "TX skb too large (%u > %u)", skb->len,
+			   BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN);
+		return -EMSGSIZE;
+	}
+
 	/* Firmware raises alive interrupt on HCI_OP_RESET or
 	 * BTINTEL_HCI_OP_RESET
 	 */
-- 
2.43.0

RE: [v1] Bluetooth: btintel_pcie: validate TX skb length in send_sync

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1158 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1160388/

---Test result---

Test Summary:
CheckPatch                    PASS      0.50 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      19.20 seconds
CheckAllWarning               PASS      20.92 seconds
CheckSparse                   PASS      20.14 seconds
BuildKernel32                 PASS      17.92 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      310.65 seconds
IncrementalBuild              PASS      17.22 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/722

---
Regards,
Linux Bluetooth

Re: [PATCH v1] Bluetooth: btintel_pcie: validate TX skb length in send_sync

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  8 Sep 2026 15:26:58 +0530 you wrote:
> btintel_pcie_prepare_tx() copies skb->len bytes into a fixed
> BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy.
> Oversized packets are currently rejected only in
> btintel_pcie_send_frame(); any future caller of
> btintel_pcie_send_sync() would silently overflow the DMA buffer.
> 
> Add the bounds check in btintel_pcie_send_sync() itself, right
> before skb_push() and the DMA copy.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: btintel_pcie: validate TX skb length in send_sync
    https://git.kernel.org/bluetooth/bluetooth-next/c/88906c2d5b21

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html