Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices

[PATCH 0/3] Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices

ZhaoJinming posted 3 patches 1 month, 1 week ago

Download series mbox

drivers/bluetooth/btintel_pcie.c | 78 ++++++++++++++++++++++++++++++++++------
1 file changed, 67 insertions(+), 11 deletions(-)

Expand all Fold all

[PATCH 0/3] Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices

Posted by ZhaoJinming 1 month, 1 week ago

This series fixes four array bounds issues in the Intel BT PCIe driver
where device-controlled indices from shared DMA memory are used to
index fixed-size arrays without proper validation.

Link: https://lore.kernel.org/all/1217891c-bf57-4c1a-9963-27400f60a5cd@molgen.mpg.de/

Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
ZhaoJinming (3):
      Bluetooth: btintel_pcie: Fix off-by-one bounds checks in synchronous paths
      Bluetooth: btintel_pcie: Fix bounds checks in TX completion handler
      Bluetooth: btintel_pcie: Fix bounds checks in RX completion handler

 drivers/bluetooth/btintel_pcie.c | 78 ++++++++++++++++++++++++++++++++++------
 1 file changed, 67 insertions(+), 11 deletions(-)
---
base-commit: a4ff2be345d0abc943da8dd8da98151843b750dc
change-id: 20260820-btintel_pcie_bounds_fixes-45a8aff3de36

Best regards,
-- 
ZhaoJinming <zhaojinming@uniontech.com>