Re: [PATCH] Bluetooth: btusb: validate QCA rampatch size

Hi Laxman,

On Thu, Jul 30, 2026 at 12:18=E2=80=AFPM Laxman Acharya Padhya
<[email protected]> wrote:
>
> btusb_setup_qca_load_rampatch() reads the rampatch version structure at
> fw->data + info->ver_offset. A truncated rampatch can therefore make the
> driver read beyond the firmware buffer while parsing the version fields.
>
> The download path also expects the complete device-specific rampatch
> header. Reject files too short to contain both the header and version
> structure before accessing either.
>
> Fixes: 3267c884cefa ("Bluetooth: btusb: Add support for QCA ROME chipset =
family")
> Cc: [email protected]
> Signed-off-by: Laxman Acharya Padhya <[email protected]>
> ---
>  drivers/bluetooth/btusb.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 8f7ed469cac..9801835d7c7 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -3526,6 +3526,7 @@ static int btusb_setup_qca_load_rampatch(struct hci=
_dev *hdev,
>         struct qca_rampatch_version *rver;
>         const struct firmware *fw;
>         const char *fw_subdir;
> +       size_t min_size;
>         u32 ver_rom, ver_patch, rver_rom;
>         u16 rver_rom_low, rver_rom_high, rver_patch;
>         char fwname[80];
> @@ -3551,6 +3552,15 @@ static int btusb_setup_qca_load_rampatch(struct hc=
i_dev *hdev,
>
>         bt_dev_info(hdev, "using rampatch file: %s", fwname);
>
> +       min_size =3D max_t(size_t, info->rampatch_hdr,
> +                        info->ver_offset + sizeof(*rver));
> +       if (fw->size < min_size) {
> +               bt_dev_err(hdev, "rampatch file is truncated (%zu < %zu)"=
,
> +                          fw->size, min_size);
> +               err =3D -EINVAL;
> +               goto done;
> +       }

Has Qualcomm engineers verified that this is the correct way to check
the image size?

>         rver =3D (struct qca_rampatch_version *)(fw->data + info->ver_off=
set);
>         rver_rom_low =3D le16_to_cpu(rver->rom_version_low);
>         rver_patch =3D le16_to_cpu(rver->patch_version);
> --
> 2.51.2
>


--=20
Luiz Augusto von Dentz