[PATCH v1 0/3] Bluetooth: btintel: security fixes

[Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>]

Three small, independent fixes found by an internal audit of the Intel
Bluetooth drivers:

  1. btintel: bound the "Exception info" print, which reads past a
     controller-supplied buffer that is not NUL-terminated.
  2. btintel_pcie: widen plen to u32 so HDR_SIZE + dlen cannot wrap
     and defeat the RX length check.
  3. btintel_pcie: reject TX packets larger than the DMA buffer
     before they reach the memcpy() in the TX submit path.

All three pass checkpatch --strict.

Chandrashekar Devegowda (3):
  Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
  Bluetooth: btintel_pcie: fix plen overflow in
    btintel_pcie_recv_frame()
  Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

 drivers/bluetooth/btintel.c      |  3 ++-
 drivers/bluetooth/btintel_pcie.c | 12 +++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)


base-commit: 06d991977eeff5d51327e1e64889e70658e8f7ff
-- 
2.43.0