The MSI-X RX and TX completion handlers trust the shared ring indices
read from data->ia.cr_tia[] and data->ia.cr_hia[] before using cr_tia as
an index into the fixed urbd ring arrays. If the device reports a stale
or malformed completion index, the driver can step past rxq->urbd1s[] or
txq->urbd0s[] before it gets a chance to recover.

Validate both completion ring indices against the queue depth before
walking the descriptor arrays.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/bluetooth/btintel_pcie.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 37b744e35bc4..06c2b81f2b6e 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1008,6 +1008,13 @@ static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data)
 
 	txq = &data->txq;
 
+	if (cr_tia >= txq->count || cr_hia >= txq->count) {
+		bt_dev_err(data->hdev,
+			   "TXQ: invalid ring indices tia=%u hia=%u",
+			   cr_tia, cr_hia);
+		return;
+	}
+
 	while (cr_tia != cr_hia) {
 		data->tx_wait_done = true;
 		wake_up(&data->tx_wait_q);
@@ -1403,6 +1410,12 @@ static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data *data)
 
 	rxq = &data->rxq;
 
+	if (cr_tia >= rxq->count || cr_hia >= rxq->count) {
+		bt_dev_err(hdev, "RXQ: invalid ring indices tia=%u hia=%u",
+			   cr_tia, cr_hia);
+		return;
+	}
+
 	/* The firmware sends multiple CD in a single MSI-X and it needs to
 	 * process all received CDs in this interrupt.
 	 */
-- 
2.50.1 (Apple Git-155)

Hi @Kiran K

On Tue, Mar 24, 2026 at 4:51 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
>
> The MSI-X RX and TX completion handlers trust the shared ring indices
> read from data->ia.cr_tia[] and data->ia.cr_hia[] before using cr_tia as
> an index into the fixed urbd ring arrays. If the device reports a stale
> or malformed completion index, the driver can step past rxq->urbd1s[] or
> txq->urbd0s[] before it gets a chance to recover.
>
> Validate both completion ring indices against the queue depth before
> walking the descriptor arrays.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/bluetooth/btintel_pcie.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 37b744e35bc4..06c2b81f2b6e 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -1008,6 +1008,13 @@ static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data)
>
>         txq = &data->txq;
>
> +       if (cr_tia >= txq->count || cr_hia >= txq->count) {
> +               bt_dev_err(data->hdev,
> +                          "TXQ: invalid ring indices tia=%u hia=%u",
> +                          cr_tia, cr_hia);
> +               return;
> +       }
> +
>         while (cr_tia != cr_hia) {
>                 data->tx_wait_done = true;
>                 wake_up(&data->tx_wait_q);
> @@ -1403,6 +1410,12 @@ static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data *data)
>
>         rxq = &data->rxq;
>
> +       if (cr_tia >= rxq->count || cr_hia >= rxq->count) {
> +               bt_dev_err(hdev, "RXQ: invalid ring indices tia=%u hia=%u",
> +                          cr_tia, cr_hia);
> +               return;
> +       }
> +
>         /* The firmware sends multiple CD in a single MSI-X and it needs to
>          * process all received CDs in this interrupt.
>          */
> --
> 2.50.1 (Apple Git-155)

Can you review these changes?

-- 
Luiz Augusto von Dentz

Hi Luiz, Pengpeng,

>Subject: Re: [PATCH] Bluetooth: btintel_pcie: validate completion ring indices
>
>Hi @Kiran K
>
>On Tue, Mar 24, 2026 at 4:51 AM Pengpeng Hou <pengpeng@iscas.ac.cn>
>wrote:
>>
>> The MSI-X RX and TX completion handlers trust the shared ring indices
>> read from data->ia.cr_tia[] and data->ia.cr_hia[] before using cr_tia
>> as an index into the fixed urbd ring arrays. If the device reports a
>> stale or malformed completion index, the driver can step past
>> rxq->urbd1s[] or
>> txq->urbd0s[] before it gets a chance to recover.
>>
>> Validate both completion ring indices against the queue depth before
>> walking the descriptor arrays.
>>
>> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
>> ---
>>  drivers/bluetooth/btintel_pcie.c | 13 +++++++++++++
>>  1 file changed, 13 insertions(+)
>>
>> diff --git a/drivers/bluetooth/btintel_pcie.c
>> b/drivers/bluetooth/btintel_pcie.c
>> index 37b744e35bc4..06c2b81f2b6e 100644
>> --- a/drivers/bluetooth/btintel_pcie.c
>> +++ b/drivers/bluetooth/btintel_pcie.c
>> @@ -1008,6 +1008,13 @@ static void btintel_pcie_msix_tx_handle(struct
>> btintel_pcie_data *data)
>>
>>         txq = &data->txq;
>>
>> +       if (cr_tia >= txq->count || cr_hia >= txq->count) {
>> +               bt_dev_err(data->hdev,
>> +                          "TXQ: invalid ring indices tia=%u hia=%u",
>> +                          cr_tia, cr_hia);
>> +               return;
>> +       }
>> +
>>         while (cr_tia != cr_hia) {
>>                 data->tx_wait_done = true;
>>                 wake_up(&data->tx_wait_q); @@ -1403,6 +1410,12 @@
>> static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data
>> *data)
>>
>>         rxq = &data->rxq;
>>
>> +       if (cr_tia >= rxq->count || cr_hia >= rxq->count) {
>> +               bt_dev_err(hdev, "RXQ: invalid ring indices tia=%u hia=%u",
>> +                          cr_tia, cr_hia);
>> +               return;
>> +       }
>> +
>>         /* The firmware sends multiple CD in a single MSI-X and it needs to
>>          * process all received CDs in this interrupt.
>>          */
>> --
>> 2.50.1 (Apple Git-155)
>
>Can you review these changes?
>
Looks good to me.

Tested-by: Kiran K <kiran.k@intel.com>
 
Thanks,
Kiran