Re: [PATCH] Bluetooth: btusb: validate QCA rampatch size

[Luiz Augusto von Dentz]

Hi Laxman,

On Thu, Jul 30, 2026 at 12:18 PM Laxman Acharya Padhya
<acharyalaxman8848@xxxxxxxxx> wrote:
>
> btusb_setup_qca_load_rampatch() reads the rampatch version structure at
> fw->data + info->ver_offset. A truncated rampatch can therefore make the
> driver read beyond the firmware buffer while parsing the version fields.
>
> The download path also expects the complete device-specific rampatch
> header. Reject files too short to contain both the header and version
> structure before accessing either.
>
> Fixes: 3267c884cefa ("Bluetooth: btusb: Add support for QCA ROME chipset family")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
> ---
>  drivers/bluetooth/btusb.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 8f7ed469cac..9801835d7c7 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -3526,6 +3526,7 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
>         struct qca_rampatch_version *rver;
>         const struct firmware *fw;
>         const char *fw_subdir;
> +       size_t min_size;
>         u32 ver_rom, ver_patch, rver_rom;
>         u16 rver_rom_low, rver_rom_high, rver_patch;
>         char fwname[80];
> @@ -3551,6 +3552,15 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
>
>         bt_dev_info(hdev, "using rampatch file: %s", fwname);
>
> +       min_size = max_t(size_t, info->rampatch_hdr,
> +                        info->ver_offset + sizeof(*rver));
> +       if (fw->size < min_size) {
> +               bt_dev_err(hdev, "rampatch file is truncated (%zu < %zu)",
> +                          fw->size, min_size);
> +               err = -EINVAL;
> +               goto done;
> +       }

Has Qualcomm engineers verified that this is the correct way to check
the image size?

>         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
>         rver_rom_low = le16_to_cpu(rver->rom_version_low);
>         rver_patch = le16_to_cpu(rver->patch_version);
> --
> 2.51.2
>


-- 
Luiz Augusto von Dentz