[PATCH v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

[PATCH v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

[Sai Teja Aluvala]

btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the
FRBD array access, allowing frbd_index == rxq->count to pass through
and index one element past the end of the array. Change the check to
>= rxq->count so every out-of-range index is rejected.

This issue was reported by Claude Mythos.

Fixes: c2b636b3f788 (Bluetooth: btintel_pcie: Add support for PCIe transport)
Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 7a2139a04ddb..4807361a58a7 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -640,7 +640,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
 
 	frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
 
-	if (frbd_index > rxq->count)
+	if (frbd_index >= rxq->count)
 		return -ERANGE;
 
 	/* Prepare for RX submit. It updates the FRBD with the address of DMA
-- 
2.53.0

RE: [v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1895 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1162859/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.64 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.30 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      22.29 seconds
CheckAllWarning               PASS      25.07 seconds
CheckSparse                   PASS      27.92 seconds
BuildKernel32                 PASS      22.20 seconds
CheckKernelLLVM               PASS      24.23 seconds
TestRunnerSetup               PASS      569.71 seconds
IncrementalBuild              PASS      21.18 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
WARNING: Please use correct Fixes: style 'Fixes: <12+ chars of sha1> ("<title line>")' - ie: 'Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")'
#86: 
Fixes: c2b636b3f788 (Bluetooth: btintel_pcie: Add support for PCIe transport)

total: 0 errors, 1 warnings, 8 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14808199.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluetooth-next/pull/754

---
Regards,
Linux Bluetooth

Re: [PATCH v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 11 Sep 2026 17:22:22 +0530 you wrote:
> btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the
> FRBD array access, allowing frbd_index == rxq->count to pass through
> and index one element past the end of the array. Change the check to
> >= rxq->count so every out-of-range index is rejected.
> 
> This issue was reported by Claude Mythos.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
    https://git.kernel.org/bluetooth/bluetooth-next/c/dc9f6261721d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html