[PW_SID:1148965] Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices - #623
Open
BluezTestBot wants to merge 8 commits into
Open
[PW_SID:1148965] Bluetooth: btintel_pcie: Fix array bounds of device-controlled indices#623BluezTestBot wants to merge 8 commits into
BluezTestBot wants to merge 8 commits into
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This replaces the bzcafe action with bluez/action-ci so we can maintain everything in the github bluez organization Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This attempts to sync every 5 minutes instead of 30. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bluez/action-ci uses master as default branch for workflow which is incorrect for kernel Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The CI action now creates individual GitHub Check Runs per test, which requires 'checks: write' permission on the GITHUB_TOKEN. Also make the pull_request trigger types explicit to include 'reopened', allowing CI to be retriggered by closing and reopening a PR.
…paths Fix two off-by-one errors where '>' should have been '>=' when checking array indices against queue count: 1. btintel_pcie_send_sync(): tfd_index from tr_hia is used to index txq->tfds[] and txq->bufs[]. When tfd_index == txq->count (32), btintel_pcie_prepare_tx() writes past the end of both arrays. 2. btintel_pcie_submit_rx(): frbd_index from tr_hia is used to index rxq->frbds[] and rxq->bufs[]. When frbd_index == rxq->count (64), btintel_pcie_prepare_rx() writes past the end of both arrays. Fixes: c2b636b ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Fix two issues in btintel_pcie_msix_tx_handle(): 1. cr_tia is a device-controlled value from shared DMA memory (data->ia.cr_tia[]) and is used to index txq->urbd0s[] without a bounds check. An out-of-range value could cause an out-of-bounds access when indexing txq->urbd0s[]. Add a bounds check before the array access. When cr_tia is out of range, reset the ring consumer pointer (data->ia.cr_tia[]) to cr_hia so the queue can recover on the next interrupt. 2. The existing check on urbd0->tfd_index uses '>' instead of '>=', allowing tfd_index == txq->count (32) to pass. This check guards against a device-controlled value, so the comparison must reject all out-of-range indices. Read tfd_index via READ_ONCE() to ensure a single atomic read from DMA-coherent memory. Fixes: c2b636b ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Fix three issues in btintel_pcie_msix_rx_handle(): 1. cr_tia is a device-controlled value from shared DMA memory (data->ia.cr_tia[]) and is used to index rxq->urbd1s[] without a bounds check. An out-of-range value could cause an out-of-bounds access when indexing rxq->urbd1s[]. Add a bounds check before the array access. When cr_tia is out of range, reset the ring consumer pointer (data->ia.cr_tia[]) to cr_hia so the queue can recover on the next interrupt. 2. urbd1->frbd_tag is a 16-bit device-controlled field (0-65535) used directly as an index into rxq->bufs[] (64 elements). Add a bounds check. Read the field via READ_ONCE() to avoid a Time-of-Check to Time-of-Use (TOCTOU) race, since the field is in DMA-coherent memory and the compiler may emit two separate reads. 3. All error paths in the while loop use 'return', which exits the handler without advancing cr_tia. This causes the RX completion queue to stall, as the next interrupt would process the same corrupted descriptor and exit again. Change to 'break' to exit the loop without further processing. Fixes: c2b636b ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
CheckKernelLLVM |
|
TestRunnerSetup |
|
IncrementalBuild |
github-actions
Bot
force-pushed
the
workflow
branch
4 times, most recently
from
August 28, 2026 00:40
5774a29 to
616126a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix two off-by-one errors where '>' should have been '>=' when
checking array indices against queue count:
btintel_pcie_send_sync(): tfd_index from tr_hia is used to index
txq->tfds[] and txq->bufs[]. When tfd_index == txq->count (32),
btintel_pcie_prepare_tx() writes past the end of both arrays.
btintel_pcie_submit_rx(): frbd_index from tr_hia is used to index
rxq->frbds[] and rxq->bufs[]. When frbd_index == rxq->count (64),
btintel_pcie_prepare_rx() writes past the end of both arrays.
Fixes: c2b636b ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: ZhaoJinming zhaojinming@uniontech.com
drivers/bluetooth/btintel_pcie.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)