[PATCH] Bluetooth: btrtl: validate firmware patch bounds

[PATCH] Bluetooth: btrtl: validate firmware patch bounds

[Laxman Acharya Padhya]

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.

Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
 drivers/bluetooth/btrtl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 49ecb18fea45..7f54d2d2d13a 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -797,8 +797,9 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
 	}
 
 	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
-	min_size = patch_offset + patch_length;
-	if (btrtl_dev->fw_len < min_size)
+	if (patch_length < sizeof(epatch_info->fw_version) ||
+	    patch_offset > btrtl_dev->fw_len ||
+	    patch_length > btrtl_dev->fw_len - patch_offset)
 		return -EINVAL;
 
 	/* Copy the firmware into a new buffer and write the version at
-- 
2.51.2

RE: Bluetooth: btrtl: validate firmware patch bounds

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1125523

---Test result---

Test Summary:
CheckPatch                    PASS      0.69 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.30 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      26.55 seconds
CheckAllWarning               PASS      29.52 seconds
CheckSparse                   PASS      27.83 seconds
BuildKernel32                 PASS      26.25 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      508.77 seconds
IncrementalBuild              PASS      26.24 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/423

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btrtl: validate firmware patch bounds

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 10 Jul 2026 23:10:03 +0545 you wrote:
> rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
> firmware version. A malformed firmware patch shorter than the version field
> can make this subtraction underflow and turn the copy into an oversized
> read and write during Bluetooth setup.
> 
> The existing patch_offset + patch_length check can also wrap on 32-bit
> architectures. Validate the patch length and range without arithmetic
> overflow before allocating or copying the patch.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: validate firmware patch bounds
    https://git.kernel.org/bluetooth/bluetooth-next/c/d09cff8f7ecf

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH] Bluetooth: btrtl: validate firmware patch bounds

[Paul Menzel]

Dear Laxman,


Thank you for your patch.

Am 10.07.26 um 19:25 schrieb Laxman Acharya Padhya:
> rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
> firmware version. A malformed firmware patch shorter than the version field
> can make this subtraction underflow and turn the copy into an oversized
> read and write during Bluetooth setup.
> 
> The existing patch_offset + patch_length check can also wrap on 32-bit
> architectures. Validate the patch length and range without arithmetic
> overflow before allocating or copying the patch.

This improvement (second paragraph) is not part of the summary/title. 
Maybe two commits would help.

> Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
> ---
>   drivers/bluetooth/btrtl.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> index 49ecb18fea45..7f54d2d2d13a 100644
> --- a/drivers/bluetooth/btrtl.c
> +++ b/drivers/bluetooth/btrtl.c
> @@ -797,8 +797,9 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
>   	}
>   
>   	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);

Unrelated, but btrtl_dev->fw_len should probably also be logged above.

> -	min_size = patch_offset + patch_length;
> -	if (btrtl_dev->fw_len < min_size)
> +	if (patch_length < sizeof(epatch_info->fw_version) ||
> +	    patch_offset > btrtl_dev->fw_len ||
> +	    patch_length > btrtl_dev->fw_len - patch_offset)
>   		return -EINVAL;
>   
>   	/* Copy the firmware into a new buffer and write the version at

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul