[PATCH 0/3] Bluetooth: btmtk: Harden firmware parsing and improve logging

[Chris Lu]

Three changes to the shared btmtk firmware download path, all in
preparation for MT7928 support but useful on their own.

Patch 1 bounds-checks the firmware image before the section map walk in
btmtk_setup_firmware_79xx(). Today the section count, the section map
array and each section's offset/length come straight out of the file and
are never compared against fw->size, so a truncated or corrupted file
makes the driver read past the end of request_firmware()'s buffer. The
section count is a __le32 from the file, so on 32-bit builds multiplying
it by the 64-byte map size wraps a size_t and a bound computed without an
overflow check would come out small enough to accept the file; both
helpers order their arithmetic so nothing can wrap. A section count of
zero is rejected too, since it passes every size check but would leave
the download loop with nothing to do and still report success.

The checks live in two helpers rather than inline because the MT7928
CBMCU download path added later needs exactly the same arithmetic and
should not carry a second copy of it. Bounding dlsize by fw->size also
removes an existing hazard in the download loop: dlen is computed as
min_t(int, 250, dl_size) from an otherwise unbounded __le32, so a large
enough value turned dlen negative and "dl_size -= dlen" then grew
dl_size instead of shrinking it.

Patch 2 makes the log line more useful: it never said which file was
requested, it reported the firmware's own hwver field as the HW version
rather than the device id the driver read from the chip, and it printed
the 16-byte datetime array with %s even though the array need not be
NUL-terminated. Both callers pass a real device id - btmtksdio reads it
from register 0x70010200 and btusb switches on it before getting here.

Patch 3 replaces the bare 1/2/3 sequence flags on BTMTK_WMT_PATCH_DWNLD
packets with a named enum. No functional change. The other bare flag
values in the driver belong to other WMT opcodes, where the field means
something different, and are left alone. Paul Menzel reviewed this change
in an earlier MT7928 series; the enum values are unchanged here, the only
difference being a comment added above it.

Testing
=======

Compile-tested with CONFIG_BT_MTK, CONFIG_BT_HCIBTUSB and
CONFIG_BT_MTKSDIO as modules, each patch applied individually, no new
warnings.

Runtime-tested on MT7922 (USB 0e8d:223c) over repeated unplug/replug and
Bluetooth on/off cycles; it comes up every time and the firmware download
is unchanged:

  [  365.233785] usb 1-2: New USB device found, idVendor=0e8d, idProduct=223c
  [  365.245951] Bluetooth: hci0: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin
  [  365.245956] Bluetooth: hci0: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260605203811
  [  367.542038] Bluetooth: hci0: Device setup in 2244536 usecs
  [  367.601570] Bluetooth: hci0: AOSP extensions version v1.00
  [  367.601581] Bluetooth: hci0: AOSP quality report is supported

Chris Lu (3):
  Bluetooth: btmtk: Validate the firmware layout before parsing it
  Bluetooth: btmtk: Improve BT firmware logging
  Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum

 drivers/bluetooth/btmtk.c | 92 +++++++++++++++++++++++++++++++++++-----
 drivers/bluetooth/btmtk.h |  9 ++++
 2 files changed, 90 insertions(+), 11 deletions(-)


base-commit: 701ca71884b3d101fd25b7adbf972355056ef352
--
2.45.2