[PATCH] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[PATCH] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[Ravindra]

btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data
buffer arrays before the index is advanced modulo txq->count. An index
equal to txq->count is one past the end of both arrays, so reject it in
the bounds check.

Signed-off-by: Ravindra <ravindra@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 59cf600014bb..aaf409a9afb1 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -536,7 +536,7 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data,
 
 	tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM];
 
-	if (tfd_index > txq->count)
+	if (tfd_index >= txq->count)
 		return -ERANGE;
 
 	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN) {
-- 
2.43.0

RE: [PATCH] Bluetooth: btintel_pcie: fix TX descriptor bounds check

[Ravindra]

Cc: chethan.tumkur.narayan@intel.com, kiran.k@intel.com

Adding Kiran and Chethan to the thread for visibility. The patch was sent
earlier; no resend is needed.

> Subject: [PATCH] Bluetooth: btintel_pcie: fix TX descriptor bounds check
> 
> btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer
> arrays before the index is advanced modulo txq->count. An index equal to
> txq->count is one past the end of both arrays, so reject it in the bounds check.
> 
> Signed-off-by: Ravindra <ravindra@intel.com>
> ---
>  drivers/bluetooth/btintel_pcie.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 59cf600014bb..aaf409a9afb1 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -536,7 +536,7 @@ static int btintel_pcie_send_sync(struct
> btintel_pcie_data *data,
> 
>  	tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM];
> 
> -	if (tfd_index > txq->count)
> +	if (tfd_index >= txq->count)
>  		return -ERANGE;
> 
>  	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE -
> BTINTEL_PCIE_HCI_TYPE_LEN) {
> --
> 2.43.0

RE: Bluetooth: btintel_pcie: fix TX descriptor bounds check

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1174948/

---Test result---

Test Summary:
CheckPatch                    PASS      0.79 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       PASS      0.38 seconds
SubjectPrefix                 PASS      0.14 seconds
BuildKernel                   PASS      30.14 seconds
CheckAllWarning               PASS      33.86 seconds
CheckSparse                   PASS      36.14 seconds
BuildKernel32                 PASS      29.54 seconds
CheckKernelLLVM               PASS      41.81 seconds
TestRunnerSetup               PASS      815.90 seconds
IncrementalBuild              PASS      29.95 seconds



https://github.com/bluez/bluetooth-next/pull/832

---
Regards,
Linux Bluetooth