[PATCH 0/3] Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices
ZhaoJinming <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <20260820-btintel_pcie_bounds_fixes-v1-0-c9dcd1ac8bf6@uniontech.com> |
This series fixes four array bounds issues in the Intel BT PCIe driver where device-controlled indices from shared DMA memory are used to index fixed-size arrays without proper validation. Link: https://lore.kernel.org/all/[email protected]/ Signed-off-by: ZhaoJinming <[email protected]> --- ZhaoJinming (3): Bluetooth: btintel_pcie: Fix off-by-one bounds checks in synchronous paths Bluetooth: btintel_pcie: Fix bounds checks in TX completion handler Bluetooth: btintel_pcie: Fix bounds checks in RX completion handler drivers/bluetooth/btintel_pcie.c | 78 ++++++++++++++++++++++++++++++++++------ 1 file changed, 67 insertions(+), 11 deletions(-) --- base-commit: a4ff2be345d0abc943da8dd8da98151843b750dc change-id: 20260820-btintel_pcie_bounds_fixes-45a8aff3de36 Best regards, -- ZhaoJinming <[email protected]>