kernel/linux.git/drivers/bluetooth/btrtl.c, branch v5.10.264

Bluetooth: btrtl: validate firmware patch bounds

2026-07-24T13:49:16+00:00

commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream. rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup. The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch. Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman

Bluetooth: btrtl: Prevent potential NULL dereference

2025-05-02T05:40:59+00:00

[ Upstream commit 324dddea321078a6eeb535c2bff5257be74c9799 ] The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' Fixes: 26503ad25de8 ("Bluetooth: btrtl: split the device initialization into smaller parts") Signed-off-by: Dan Carpenter Reviewed-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin

Bluetooth: btrtl: Add support for RTL8761B

2020-04-11T05:58:23+00:00

Add new compatible device RTL8761B. RTL8761B is a USB Bluetooth device, with support of BLE and BR/EDR. The USB info is T: Bus=03 Lev=04 Prnt=04 Port=00 Cnt=01 Dev#= 29 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=8771 Rev= 2.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=XXXXXXXXXXXX C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Ziqian SUN (Zamir) Signed-off-by: Marcel Holtmann

Bluetooth: hci_h5: btrtl: Add support for RTL8822C

2020-02-18T08:22:22+00:00

Add new compatible and FW loading support for RTL8822C. Signed-off-by: Max Chou Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: Use kvmalloc for FW allocations

2020-01-24T18:57:53+00:00

Currently, kmemdup is applied to the firmware data, and it invokes kmalloc under the hood. The firmware size and patch_length are big (more than PAGE_SIZE), and on some low-end systems (like ASUS E202SA) kmalloc may fail to allocate a contiguous chunk under high memory usage and fragmentation: Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000a lmp_ver=06 lmp_subver=8821 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: loading rtl_bt/rtl8821a_fw.bin kworker/u9:2: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 As firmware load happens on each resume, Bluetooth will stop working after several iterations, when the kernel fails to allocate an order-4 page. This patch replaces kmemdup with kvmalloc+memcpy. It's not required to have a contiguous chunk here, because it's not mapped to the device directly. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: remove unneeded semicolon

2019-10-26T05:23:30+00:00

Remove unneeded semicolon. This is detected by coccinelle. Signed-off-by: YueHaibing Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: Fix an issue for the incorrect error return code.

2019-10-16T17:26:40+00:00

It does not need the '-' for PTR_ERR(skb) because PTR_ERR(skb) will return the negative value during errors. Signed-off-by: Max Chou Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: Fix an issue that failing to download the FW which size is over 32K bytes

2019-09-05T15:27:32+00:00

Fix the issue that when the FW size is 32K+, it will fail for the download process because of the incorrect index. When firmware patch length is over 32K, "dl_cmd->index" may >= 0x80. It will be thought as "data end" that download process will not complete. However, driver should recount the index from 1. Signed-off-by: Max Chou Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: Remove trailing newline from calls to rtl_dev macros

2019-09-05T15:27:22+00:00

These printing macros already add a trailing newline, so drop these unnecessary additional newlines. Signed-off-by: Alex Lu Signed-off-by: Marcel Holtmann

Bluetooth: btrtl: Remove redundant prefix from calls to rtl_dev macros

2019-09-05T15:27:22+00:00

the rtl: or RTL: prefix in the string is pointless. The rtl_dev_* macros already does that. Signed-off-by: Alex Lu Signed-off-by: Marcel Holtmann