[PATCH] Bluetooth: btintel_pcie: fix off-by-one in RX queue bounds check

[Junrui Luo]

btintel_pcie_submit_rx() reads frbd_index and validates it against
rxq->count. Since rxq->frbds[] and rxq->bufs[] are allocated with
rxq->count entries, valid indices are 0 to rxq->count - 1. The current
check uses > instead of >=, allowing frbd_index == rxq->count through.

This causes an out-of-bounds access in btintel_pcie_prepare_rx() when
writing to rxq->bufs[frbd_index] and rxq->frbds[frbd_index].

Fix by using >= so that frbd_index == rxq->count is correctly rejected.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 37b744e35bc4..cbadcfe86321 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -460,7 +460,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
 
 	frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
 
-	if (frbd_index > rxq->count)
+	if (frbd_index >= rxq->count)
 		return -ERANGE;
 
 	/* Prepare for RX submit. It updates the FRBD with the address of DMA

---
base-commit: c369299895a591d96745d6492d4888259b004a9e
change-id: 20260324-fixes-8c301e8881f0

Best regards,
-- 
Junrui Luo <moonafterrain@xxxxxxxxxxx>