Re: [PATCH] Bluetooth: btrtl: validate firmware patch bounds

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Fri, 10 Jul 2026 23:10:03 +0545 you wrote:
> rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
> firmware version. A malformed firmware patch shorter than the version field
> can make this subtraction underflow and turn the copy into an oversized
> read and write during Bluetooth setup.
> 
> The existing patch_offset + patch_length check can also wrap on 32-bit
> architectures. Validate the patch length and range without arithmetic
> overflow before allocating or copying the patch.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: validate firmware patch bounds
    https://git.kernel.org/bluetooth/bluetooth-next/c/d09cff8f7ecf

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html