* [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one @ 2026-03-24 8:51 Pengpeng Hou 2026-03-24 10:13 ` bluez.test.bot 2026-03-24 15:05 ` [PATCH] " Luiz Augusto von Dentz 0 siblings, 2 replies; 4+ messages in thread From: Pengpeng Hou @ 2026-03-24 8:51 UTC (permalink / raw) To: marcel, luiz.dentz; +Cc: linux-bluetooth, linux-kernel, pengpeng btintel_pcie_send_sync() reads the next transmit slot from data->ia.tr_hia[] and uses it as an index into the fixed txq descriptor arrays. The current guard only rejects values strictly greater than txq->count, so an index equal to the queue depth still falls through and is used as the next transmit slot one element past the end. Reject indices at or above the queue depth before preparing the TX descriptor. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> --- drivers/bluetooth/btintel_pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c index 37b744e35bc4..760cb3d1aa18 100644 --- a/drivers/bluetooth/btintel_pcie.c +++ b/drivers/bluetooth/btintel_pcie.c @@ -359,7 +359,7 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data, tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM]; - if (tfd_index > txq->count) + if (tfd_index >= txq->count) return -ERANGE; /* Firmware raises alive interrupt on HCI_OP_RESET or -- 2.50.1 (Apple Git-155) ^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: Bluetooth: btintel_pcie: fix TX queue off-by-one 2026-03-24 8:51 [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one Pengpeng Hou @ 2026-03-24 10:13 ` bluez.test.bot 2026-03-24 15:05 ` [PATCH] " Luiz Augusto von Dentz 1 sibling, 0 replies; 4+ messages in thread From: bluez.test.bot @ 2026-03-24 10:13 UTC (permalink / raw) To: linux-bluetooth, pengpeng [-- Attachment #1: Type: text/plain, Size: 2833 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1071503 ---Test result--- Test Summary: CheckPatch PENDING 0.55 seconds GitLint PENDING 0.33 seconds SubjectPrefix PASS 0.07 seconds BuildKernel PASS 27.28 seconds CheckAllWarning PASS 30.18 seconds CheckSparse PASS 29.15 seconds BuildKernel32 PASS 26.89 seconds TestRunnerSetup PASS 587.68 seconds TestRunner_l2cap-tester PASS 28.58 seconds TestRunner_iso-tester FAIL 33.90 seconds TestRunner_bnep-tester PASS 6.61 seconds TestRunner_mgmt-tester FAIL 118.32 seconds TestRunner_rfcomm-tester PASS 9.80 seconds TestRunner_sco-tester FAIL 14.81 seconds TestRunner_ioctl-tester PASS 10.66 seconds TestRunner_mesh-tester FAIL 12.61 seconds TestRunner_smp-tester PASS 8.91 seconds TestRunner_userchan-tester PASS 6.85 seconds IncrementalBuild PENDING 0.56 seconds Details ############################## Test: CheckPatch - PENDING Desc: Run checkpatch.pl script Output: ############################## Test: GitLint - PENDING Desc: Run gitlint Output: ############################## Test: TestRunner_iso-tester - FAIL Desc: Run iso-tester with test-runner Output: BUG: KASAN: slab-use-after-free in le_read_features_complete+0x7e/0x2b0 Total: 141, Passed: 141 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner_mgmt-tester - FAIL Desc: Run mgmt-tester with test-runner Output: Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4 Failed Test Cases Read Exp Feature - Success Failed 0.113 seconds ############################## Test: TestRunner_sco-tester - FAIL Desc: Run sco-tester with test-runner Output: WARNING: possible circular locking dependency detected BUG: sleeping function called from invalid context at net/core/sock.c:3782 Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner_mesh-tester - FAIL Desc: Run mesh-tester with test-runner Output: Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0 Failed Test Cases Mesh - Send cancel - 1 Timed out 2.569 seconds Mesh - Send cancel - 2 Timed out 1.995 seconds ############################## Test: IncrementalBuild - PENDING Desc: Incremental build with the patches in the series Output: --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one 2026-03-24 8:51 [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one Pengpeng Hou 2026-03-24 10:13 ` bluez.test.bot @ 2026-03-24 15:05 ` Luiz Augusto von Dentz 2026-03-27 12:31 ` K, Kiran 1 sibling, 1 reply; 4+ messages in thread From: Luiz Augusto von Dentz @ 2026-03-24 15:05 UTC (permalink / raw) To: Pengpeng Hou; +Cc: marcel, linux-bluetooth, linux-kernel Hi @Kiran K On Tue, Mar 24, 2026 at 4:51 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote: > > btintel_pcie_send_sync() reads the next transmit slot from > data->ia.tr_hia[] and uses it as an index into the fixed txq descriptor > arrays. The current guard only rejects values strictly greater than > txq->count, so an index equal to the queue depth still falls through and > is used as the next transmit slot one element past the end. > > Reject indices at or above the queue depth before preparing the TX > descriptor. > > Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> > --- > drivers/bluetooth/btintel_pcie.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c > index 37b744e35bc4..760cb3d1aa18 100644 > --- a/drivers/bluetooth/btintel_pcie.c > +++ b/drivers/bluetooth/btintel_pcie.c > @@ -359,7 +359,7 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data, > > tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM]; > > - if (tfd_index > txq->count) > + if (tfd_index >= txq->count) > return -ERANGE; > > /* Firmware raises alive interrupt on HCI_OP_RESET or > -- > 2.50.1 (Apple Git-155) Looks valid to me, index starts from 0 while count start from 1, so index == count would probably overflow as well. -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one 2026-03-24 15:05 ` [PATCH] " Luiz Augusto von Dentz @ 2026-03-27 12:31 ` K, Kiran 0 siblings, 0 replies; 4+ messages in thread From: K, Kiran @ 2026-03-27 12:31 UTC (permalink / raw) To: Luiz Augusto von Dentz, Pengpeng Hou Cc: marcel@holtmann.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Srivatsa, Ravishankar, Tumkur Narayan, Chethan Hi Luiz, Pengpeng, >Subject: Re: [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one > >Hi @Kiran K > >On Tue, Mar 24, 2026 at 4:51 AM Pengpeng Hou <pengpeng@iscas.ac.cn> >wrote: >> >> btintel_pcie_send_sync() reads the next transmit slot from >> data->ia.tr_hia[] and uses it as an index into the fixed txq >> data->descriptor >> arrays. The current guard only rejects values strictly greater than >> txq->count, so an index equal to the queue depth still falls through >> txq->and >> is used as the next transmit slot one element past the end. >> >> Reject indices at or above the queue depth before preparing the TX >> descriptor. >> >> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> >> --- >> drivers/bluetooth/btintel_pcie.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/bluetooth/btintel_pcie.c >> b/drivers/bluetooth/btintel_pcie.c >> index 37b744e35bc4..760cb3d1aa18 100644 >> --- a/drivers/bluetooth/btintel_pcie.c >> +++ b/drivers/bluetooth/btintel_pcie.c >> @@ -359,7 +359,7 @@ static int btintel_pcie_send_sync(struct >> btintel_pcie_data *data, >> >> tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM]; >> >> - if (tfd_index > txq->count) >> + if (tfd_index >= txq->count) Unless the firmware corrupts DMA memory (or there's a serious firmware bug), tfd_index should never reach or exceed txq->count. With that in mind, the change looks good to me. >> return -ERANGE; >> >> /* Firmware raises alive interrupt on HCI_OP_RESET or >> -- >> 2.50.1 (Apple Git-155) > >Looks valid to me, index starts from 0 while count start from 1, so index == count >would probably overflow as well. > >-- >Luiz Augusto von Dentz Thanks, Kiran ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-27 12:31 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-03-24 8:51 [PATCH] Bluetooth: btintel_pcie: fix TX queue off-by-one Pengpeng Hou 2026-03-24 10:13 ` bluez.test.bot 2026-03-24 15:05 ` [PATCH] " Luiz Augusto von Dentz 2026-03-27 12:31 ` K, Kiran
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox