[PATCH v2 1/2] Bluetooth: btintel_pcie: validate packet_len before skb_put_data

[PATCH v2 1/2] Bluetooth: btintel_pcie: validate packet_len before skb_put_data

[Kiran K]

btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without
checking if it exceeds the RX buffer size. An oversized packet_len
can lead to an out-of-bounds read in skb_put_data().

Validate packet_len to ensure it is non-zero and does not exceed
BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when
invalid.

This issue was reported by Claude Mythos. It can be simulated either by
using customized firmware configured to return an invalid packet_len or
by modifying rfh_hdr->packet_len in the driver before calling
btintel_pcie_submit_rx_work().

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Kiran K <kiran.k@intel.com>
---
changes in v2:
- Update commit message
- Add more debug information in error message

 drivers/bluetooth/btintel_pcie.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 30923eaabed7..281dc5261c74 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1954,7 +1954,9 @@ static int btintel_pcie_submit_rx_work(struct btintel_pcie_data *data, u8 status
 	rfh_hdr = buf;
 
 	len = rfh_hdr->packet_len;
-	if (len <= 0) {
+	if (len == 0 || len > BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr)) {
+		bt_dev_err(data->hdev, "Invalid packet_len %d (max %zu)", len,
+			   BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr));
 		ret = -EINVAL;
 		goto resubmit;
 	}
-- 
2.54.0

[PATCH v2 2/2] Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

[Kiran K]

Valid indices into txq->urbd0s/tfds/bufs are 0..txq->count-1, so
tfd_index == txq->count is already out of range. Change the guard in
btintel_pcie_msix_tx_handle() from '> txq->count' to '>= txq->count'.

This issue was reported by Claude Mythos.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Kiran K <kiran.k@intel.com>
---
changes in v2:
- Update commit message

 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 281dc5261c74..e02f8ae8d8d9 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1423,7 +1423,7 @@ static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data)
 
 		urbd0 = &txq->urbd0s[cr_tia];
 
-		if (urbd0->tfd_index > txq->count)
+		if (urbd0->tfd_index >= txq->count)
 			return;
 
 		cr_tia = (cr_tia + 1) % txq->count;
-- 
2.54.0

RE: [v2,1/2] Bluetooth: btintel_pcie: validate packet_len before skb_put_data

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1157183

---Test result---

Test Summary:
CheckPatch                    PASS      1.24 seconds
VerifyFixes                   PASS      0.34 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.49 seconds
SubjectPrefix                 PASS      0.18 seconds
BuildKernel                   PASS      27.59 seconds
CheckAllWarning               PASS      30.26 seconds
CheckSparse                   PASS      28.69 seconds
BuildKernel32                 PASS      26.25 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      502.53 seconds
IncrementalBuild              PASS      27.20 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/696

---
Regards,
Linux Bluetooth

Re: [PATCH v2 1/2] Bluetooth: btintel_pcie: validate packet_len before skb_put_data

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  3 Sep 2026 20:21:01 +0530 you wrote:
> btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without
> checking if it exceeds the RX buffer size. An oversized packet_len
> can lead to an out-of-bounds read in skb_put_data().
> 
> Validate packet_len to ensure it is non-zero and does not exceed
> BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when
> invalid.
> 
> [...]

Here is the summary with links:
  - [v2,1/2] Bluetooth: btintel_pcie: validate packet_len before skb_put_data
    https://git.kernel.org/bluetooth/bluetooth-next/c/de8d29ede6f3
  - [v2,2/2] Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
    https://git.kernel.org/bluetooth/bluetooth-next/c/a8bfcece8b49

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH v2 2/2] Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

[Paul Menzel]

Dear Kiran,


Thank you for your patch.

Am 03.09.26 um 16:51 schrieb Kiran K:
> Valid indices into txq->urbd0s/tfds/bufs are 0..txq->count-1, so
> tfd_index == txq->count is already out of range. Change the guard in
> btintel_pcie_msix_tx_handle() from '> txq->count' to '>= txq->count'.
> 
> This issue was reported by Claude Mythos.
> 
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Signed-off-by: Kiran K <kiran.k@intel.com>
> ---
> changes in v2:
> - Update commit message
> 
>   drivers/bluetooth/btintel_pcie.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 281dc5261c74..e02f8ae8d8d9 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -1423,7 +1423,7 @@ static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data)
>   
>   		urbd0 = &txq->urbd0s[cr_tia];
>   
> -		if (urbd0->tfd_index > txq->count)
> +		if (urbd0->tfd_index >= txq->count)
>   			return;
>   
>   		cr_tia = (cr_tia + 1) % txq->count;

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: I must be blind, but I can’t find this on sashiko.dev [1].


[1]: https://sashiko.dev/#/?list=org.kernel.vger.linux-bluetooth