[PATCH] Bluetooth: btrtl: validate firmware patch bounds

[PATCH] Bluetooth: btrtl: validate firmware patch bounds

[Laxman Acharya Padhya]

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.

Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
 drivers/bluetooth/btrtl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 49ecb18fea45..7f54d2d2d13a 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -797,8 +797,9 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
 	}
 
 	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
-	min_size = patch_offset + patch_length;
-	if (btrtl_dev->fw_len < min_size)
+	if (patch_length < sizeof(epatch_info->fw_version) ||
+	    patch_offset > btrtl_dev->fw_len ||
+	    patch_length > btrtl_dev->fw_len - patch_offset)
 		return -EINVAL;
 
 	/* Copy the firmware into a new buffer and write the version at
-- 
2.51.2

Re: [PATCH] Bluetooth: btrtl: validate firmware patch bounds

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 10 Jul 2026 23:10:03 +0545 you wrote:
> rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
> firmware version. A malformed firmware patch shorter than the version field
> can make this subtraction underflow and turn the copy into an oversized
> read and write during Bluetooth setup.
> 
> The existing patch_offset + patch_length check can also wrap on 32-bit
> architectures. Validate the patch length and range without arithmetic
> overflow before allocating or copying the patch.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: validate firmware patch bounds
    https://git.kernel.org/bluetooth/bluetooth-next/c/d09cff8f7ecf

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH] Bluetooth: btrtl: validate firmware patch bounds

[Paul Menzel]

Dear Laxman,


Thank you for your patch.

Am 10.07.26 um 19:25 schrieb Laxman Acharya Padhya:
> rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
> firmware version. A malformed firmware patch shorter than the version field
> can make this subtraction underflow and turn the copy into an oversized
> read and write during Bluetooth setup.
> 
> The existing patch_offset + patch_length check can also wrap on 32-bit
> architectures. Validate the patch length and range without arithmetic
> overflow before allocating or copying the patch.

This improvement (second paragraph) is not part of the summary/title. 
Maybe two commits would help.

> Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
> ---
>   drivers/bluetooth/btrtl.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> index 49ecb18fea45..7f54d2d2d13a 100644
> --- a/drivers/bluetooth/btrtl.c
> +++ b/drivers/bluetooth/btrtl.c
> @@ -797,8 +797,9 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
>   	}
>   
>   	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);

Unrelated, but btrtl_dev->fw_len should probably also be logged above.

> -	min_size = patch_offset + patch_length;
> -	if (btrtl_dev->fw_len < min_size)
> +	if (patch_length < sizeof(epatch_info->fw_version) ||
> +	    patch_offset > btrtl_dev->fw_len ||
> +	    patch_length > btrtl_dev->fw_len - patch_offset)
>   		return -EINVAL;
>   
>   	/* Copy the firmware into a new buffer and write the version at

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul