[PATCH] Bluetooth: btintel_pcie: fix off-by-one in RX queue bounds check

[PATCH] Bluetooth: btintel_pcie: fix off-by-one in RX queue bounds check

[Junrui Luo]

btintel_pcie_submit_rx() reads frbd_index and validates it against
rxq->count. Since rxq->frbds[] and rxq->bufs[] are allocated with
rxq->count entries, valid indices are 0 to rxq->count - 1. The current
check uses > instead of >=, allowing frbd_index == rxq->count through.

This causes an out-of-bounds access in btintel_pcie_prepare_rx() when
writing to rxq->bufs[frbd_index] and rxq->frbds[frbd_index].

Fix by using >= so that frbd_index == rxq->count is correctly rejected.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 37b744e35bc4..cbadcfe86321 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -460,7 +460,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
 
 	frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
 
-	if (frbd_index > rxq->count)
+	if (frbd_index >= rxq->count)
 		return -ERANGE;
 
 	/* Prepare for RX submit. It updates the FRBD with the address of DMA

---
base-commit: c369299895a591d96745d6492d4888259b004a9e
change-id: 20260324-fixes-8c301e8881f0

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH] Bluetooth: btintel_pcie: fix off-by-one in RX queue bounds check

[Luiz Augusto von Dentz]

Hi @Kiran K

On Tue, Mar 24, 2026 at 9:27 AM Junrui Luo <moonafterrain@outlook.com> wrote:
>
> btintel_pcie_submit_rx() reads frbd_index and validates it against
> rxq->count. Since rxq->frbds[] and rxq->bufs[] are allocated with
> rxq->count entries, valid indices are 0 to rxq->count - 1. The current
> check uses > instead of >=, allowing frbd_index == rxq->count through.
>
> This causes an out-of-bounds access in btintel_pcie_prepare_rx() when
> writing to rxq->bufs[frbd_index] and rxq->frbds[frbd_index].
>
> Fix by using >= so that frbd_index == rxq->count is correctly rejected.
>
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  drivers/bluetooth/btintel_pcie.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 37b744e35bc4..cbadcfe86321 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -460,7 +460,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
>
>         frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
>
> -       if (frbd_index > rxq->count)
> +       if (frbd_index >= rxq->count)
>                 return -ERANGE;
>
>         /* Prepare for RX submit. It updates the FRBD with the address of DMA
>
> ---
> base-commit: c369299895a591d96745d6492d4888259b004a9e
> change-id: 20260324-fixes-8c301e8881f0
>
> Best regards,
> --
> Junrui Luo <moonafterrain@outlook.com>

This one seems valid as well.

-- 
Luiz Augusto von Dentz