From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Kiran K <kiran.k@intel.com>,
Marcel Holtmann <marcel@holtmann.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10.y 1/4] Bluetooth: btintel: Fix offset calculation boot address parameter
Date: Tue, 14 Jul 2026 09:26:47 -0400 [thread overview]
Message-ID: <20260714132650.2663656-1-sashal@kernel.org> (raw)
In-Reply-To: <2026071309-contempt-purposely-3c5c@gregkh>
From: Kiran K <kiran.k@intel.com>
[ Upstream commit d00745da644d42c2f97293eb3fe19cfd5c0b073c ]
Boot address parameter was not getting updated properly
due to wrong offset
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Stable-dep-of: c5b600a3c05b ("Bluetooth: btusb: fix use-after-free on marvell probe failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btintel.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 2538bdee31d8ab..a7efbadc3d146e 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -863,7 +863,8 @@ static int btintel_download_firmware_payload(struct hci_dev *hdev,
/* The boot parameter is the first 32-bit value
* and rest of 3 octets are reserved.
*/
- *boot_param = get_unaligned_le32(fw_ptr + sizeof(*cmd));
+ *boot_param = get_unaligned_le32(fw_ptr + frag_len +
+ sizeof(*cmd));
bt_dev_dbg(hdev, "boot_param=0x%x", *boot_param);
}
--
2.53.0
next prev parent reply other threads:[~2026-07-14 13:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-13 13:09 FAILED: patch "[PATCH] Bluetooth: btusb: fix use-after-free on marvell probe failure" failed to apply to 5.10-stable tree gregkh
2026-07-14 13:26 ` Sasha Levin [this message]
2026-07-14 13:26 ` [PATCH 5.10.y 2/4] Bluetooth: btintel: Check firmware version before download Sasha Levin
2026-07-14 13:26 ` [PATCH 5.10.y 3/4] Bluetooth: btusb: fix use-after-free on registration failure Sasha Levin
2026-07-14 13:26 ` [PATCH 5.10.y 4/4] Bluetooth: btusb: fix use-after-free on marvell probe failure Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260714132650.2663656-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=kiran.k@intel.com \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox