github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/bluetooth
History
Sai Teja Aluvala 2ea5a87a5a Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit 
btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the
FRBD array access, allowing frbd_index == rxq->count to pass through
and index one element past the end of the array. Change the check to
>= rxq->count so every out-of-range index is rejected.

This issue was reported by Claude Mythos.

Fixes: c2b636b3f7 (Bluetooth: btintel_pcie: Add support for PCIe transport)
Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-09-15 14:55:27 -04:00
..
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c Bluetooth: bcm203x: remove superfluous header files 2022-03-18 17:12:09 +01:00
bfusb.c Bluetooth: bfusb: validate received block boundaries 2026-08-07 12:36:22 -04:00
bpa10x.c Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 2026-07-06 10:46:58 -04:00
btbcm.c Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth 2026-04-10 10:22:21 -04:00
btbcm.h Bluetooth: hci_bcm: Add support for FW loading in autobaud mode 2022-07-21 17:04:38 -07:00
btintel_pcie.c Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit 2026-09-15 14:55:27 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: split coredump worker into per-trigger works 2026-08-07 12:35:01 -04:00
btintel.c Bluetooth: btintel: propagate version TLV parsing errors 2026-08-31 13:40:59 -04:00
btintel.h Bluetooth: btintel: Add Bluetooth SAR revision 2 support 2026-08-07 15:38:32 -04:00
btmrvl_debugfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_drv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_main.c Bluetooth: btmrvl: fix event packet length validation 2026-08-07 15:39:06 -04:00
btmrvl_sdio.c Bluetooth: btmrvl_sdio: Do not free HCI_VENDOR_PKT frame by hci_recv_frame() 2026-08-07 15:38:31 -04:00
btmrvl_sdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmtk.c Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events 2026-09-15 14:54:48 -04:00
btmtk.h Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware 2026-09-08 17:11:42 -04:00
btmtksdio.c Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown 2026-09-15 14:55:01 -04:00
btmtkuart.c Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access 2026-09-15 14:54:54 -04:00
btnxpuart.c Including fixes from Bluetooth, IPSec and Netfilter. 2026-08-27 13:53:43 -07:00
btqca.c Bluetooth: btqca: Simplify qca_send_reset() by using __hci_reset_sync() 2026-08-07 12:31:15 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev 2026-09-08 17:13:54 -04:00
btrsi.c Bluetooth: btrsi: Move set_bt_context after successful HCI registration 2026-08-07 15:38:30 -04:00
btrtl.c Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 2026-09-08 17:04:10 -04:00
btrtl.h Bluetooth: btrtl: Add Realtek devcoredump support 2023-08-11 11:35:14 -07:00
btsdio.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btusb.c Bluetooth: btusb: fix NXP IW610 composite device handling 2026-09-15 14:26:10 -04:00
hci_ag6xx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_aml.c Bluetooth: hci_aml: validate firmware segment lengths 2026-08-07 15:38:32 -04:00
hci_ath.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_bcm.c Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative 2026-08-24 13:04:03 -04:00
hci_bcm4377.c Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 2026-08-24 13:10:49 -04:00
hci_bcsp.c Bluetooth: hci_bcsp: validate received packet lengths 2026-08-07 15:38:29 -04:00
hci_h4.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h5.c Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative 2026-08-24 13:04:11 -04:00
hci_intel.c Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative 2026-08-24 13:04:18 -04:00
hci_ldisc.c Bluetooth: hci_uart: Fix false success return in hci_uart_setup() 2026-08-24 13:13:20 -04:00
hci_ll.c Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x 2026-04-13 09:19:42 -04:00
hci_mrvl.c Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() 2026-08-31 14:05:27 -04:00
hci_nokia.c Bluetooth: hci_nokia: validate firmware packet bounds 2026-08-07 12:33:41 -04:00
hci_qca.c Bluetooth: hci_qca: Do not write to the serial port after it is closed 2026-09-15 14:52:19 -04:00
hci_serdev.c Bluetooth: hci_uart: Fix false success return in hci_uart_setup() 2026-08-24 13:13:20 -04:00
hci_uart.h Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_vhci.c Bluetooth: vhci: validate devcoredump state before side effects 2026-06-11 14:24:41 -04:00
Kconfig bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
Makefile Bluetooth: enable context analysis 2026-08-07 12:27:20 -04:00
virtio_bt.c Bluetooth: virtio_bt: avoid OOB read of build info string 2026-08-07 15:38:32 -04:00