diff options
| author | Chandrashekar Devegowda <chandrashekar.devegowda@intel.com> | 2026-09-08 15:26:58 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-09-15 14:49:34 -0400 |
| commit | 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9 (patch) | |
| tree | 29a3afd91dcfe11acc1a589d2e3224e9a33e2cee /include | |
| parent | 6610c6fe4b8936c232048e6049bf77c70a6f759c (diff) | |
Bluetooth: btintel_pcie: validate TX skb length in send_sync
btintel_pcie_prepare_tx() copies skb->len bytes into a fixed
BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy.
Oversized packets are currently rejected only in
btintel_pcie_send_frame(); any future caller of
btintel_pcie_send_sync() would silently overflow the DMA buffer.
Add the bounds check in btintel_pcie_send_sync() itself, right
before skb_push() and the DMA copy.
Assisted-by: Copilot:claude-sonnet-5 code-review code-generation
Fixes: 6e65a09f9275 ("Bluetooth: btintel_pcie: Add *setup* function to download firmware")
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions