[PATCH v1 0/3] Bluetooth: btintel: security fixes

[PATCH v1 0/3] Bluetooth: btintel: security fixes

[Chandrashekar Devegowda]

Three small, independent fixes found by an internal audit of the Intel
Bluetooth drivers:

  1. btintel: bound the "Exception info" print, which reads past a
     controller-supplied buffer that is not NUL-terminated.
  2. btintel_pcie: widen plen to u32 so HDR_SIZE + dlen cannot wrap
     and defeat the RX length check.
  3. btintel_pcie: reject TX packets larger than the DMA buffer
     before they reach the memcpy() in the TX submit path.

All three pass checkpatch --strict.

Chandrashekar Devegowda (3):
  Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
  Bluetooth: btintel_pcie: fix plen overflow in
    btintel_pcie_recv_frame()
  Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

 drivers/bluetooth/btintel.c      |  3 ++-
 drivers/bluetooth/btintel_pcie.c | 12 +++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)


base-commit: 06d991977eeff5d51327e1e64889e70658e8f7ff
-- 
2.43.0

[PATCH v1 1/3] Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

[Chandrashekar Devegowda]

The "Exception info %s" print uses skb->data + 1, but the 12-byte
payload is not guaranteed to be NUL-terminated and can be read past
its end.

Bound the print with "%.*s" and skb->len - 1.

Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
---
 drivers/bluetooth/btintel.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 5e6d1ddc99c6..12bf795db84e 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -290,7 +290,8 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
 		goto unlock;
 	}
 
-	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+		   (char *)(skb->data + 1));
 
 	kfree_skb(skb);
 
-- 
2.43.0

[PATCH v1 2/3] Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

[Chandrashekar Devegowda]

plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen
is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the
"skb->len < plen" check and letting skb_trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 444cc50174fb..734ff8f6363f 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2163,7 +2163,7 @@ static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
 {
 	int ret;
 	u8 pkt_type;
-	u16 plen;
+	u32 plen;
 	u32 pcie_pkt_type;
 	void *pdata;
 	struct hci_dev *hdev = data->hdev;
-- 
2.43.0

[PATCH v1 3/3] Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

[Chandrashekar Devegowda]

btintel_pcie_send_frame() eventually copies skb->data into a fixed
BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in
btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.
A user-space process with HCI_CHANNEL_USER access can inject an
oversized packet and overflow the buffer.

Reject packets larger than
BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup* function to download firmware")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 734ff8f6363f..01278ff62ffd 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -3235,6 +3235,16 @@ static int btintel_pcie_send_frame(struct hci_dev *hdev,
 	if (test_bit(BTINTEL_PCIE_RECOVERY_IN_PROGRESS, &data->flags))
 		return -ENODEV;
 
+	/* Account for the 4-byte PCIe type header prepended before the
+	 * DMA copy.  Written as a subtraction to avoid wrap-around on
+	 * attacker-controlled skb->len.
+	 */
+	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN) {
+		bt_dev_err(hdev, "Packet too large: %u > %u", skb->len,
+			   BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN);
+		return -EMSGSIZE;
+	}
+
 	/* Due to the fw limitation, the type header of the packet should be
 	 * 4 bytes unlike 1 byte for UART. In UART, the firmware can read
 	 * the first byte to get the packet type and redirect the rest of data
-- 
2.43.0

RE: Bluetooth: btintel: security fixes

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1171032/

---Test result---

Test Summary:
CheckPatch                    PASS      2.08 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.98 seconds
SubjectPrefix                 PASS      0.33 seconds
BuildKernel                   PASS      28.35 seconds
CheckAllWarning               PASS      32.16 seconds
CheckSparse                   PASS      35.56 seconds
BuildKernel32                 PASS      29.98 seconds
CheckKernelLLVM               PASS      35.27 seconds
TestRunnerSetup               PASS      760.21 seconds
IncrementalBuild              PASS      30.85 seconds



https://github.com/bluez/bluetooth-next/pull/812

---
Regards,
Linux Bluetooth

Re: [PATCH v1 0/3] Bluetooth: btintel: security fixes

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 22 Sep 2026 12:10:19 +0530 you wrote:
> Three small, independent fixes found by an internal audit of the Intel
> Bluetooth drivers:
> 
>   1. btintel: bound the "Exception info" print, which reads past a
>      controller-supplied buffer that is not NUL-terminated.
>   2. btintel_pcie: widen plen to u32 so HDR_SIZE + dlen cannot wrap
>      and defeat the RX length check.
>   3. btintel_pcie: reject TX packets larger than the DMA buffer
>      before they reach the memcpy() in the TX submit path.
> 
> [...]

Here is the summary with links:
  - [v1,1/3] Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
    https://git.kernel.org/bluetooth/bluetooth-next/c/4145a13c1a04
  - [v1,2/3] Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
    https://git.kernel.org/bluetooth/bluetooth-next/c/6d21e89e6977
  - [v1,3/3] Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
    https://git.kernel.org/bluetooth/bluetooth-next/c/2b036342b623

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html