[PATCH v2] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[PATCH v2] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[Ravindra]

btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data
buffer arrays before the index is advanced modulo txq->count. An index
equal to txq->count is one past the end of both arrays, so reject it in
the bounds check.

Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup* function to download firmware")
Signed-off-by: Ravindra <ravindra@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 84a6cf2f4920..b4142a78a049 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -536,7 +536,7 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data,
 
 	tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM];
 
-	if (tfd_index > txq->count)
+	if (tfd_index >= txq->count)
 		return -ERANGE;
 
 	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN) {
-- 
2.43.0

RE: [v2] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1175817/

---Test result---

Test Summary:
CheckPatch                    PASS      0.60 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      5.67 seconds
SubjectPrefix                 PASS      0.65 seconds
BuildKernel                   PASS      33.34 seconds
CheckAllWarning               PASS      35.91 seconds
CheckSparse                   PASS      47.68 seconds
BuildKernel32                 PASS      30.27 seconds
CheckKernelLLVM               PASS      36.10 seconds
TestRunnerSetup               PASS      819.43 seconds
IncrementalBuild              PASS      30.35 seconds



https://github.com/bluez/bluetooth-next/pull/839

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 29 Sep 2026 12:26:41 +0530 you wrote:
> btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data
> buffer arrays before the index is advanced modulo txq->count. An index
> equal to txq->count is one past the end of both arrays, so reject it in
> the bounds check.
> 
> Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup* function to download firmware")
> Signed-off-by: Ravindra <ravindra@intel.com>
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: btintel_pcie: fix TX descriptor bounds check
    https://git.kernel.org/bluetooth/bluetooth-next/c/baa53af641c9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html