fix(core): fix irq locking in ble driver
What the developer wrote
Authored by cepetr
fix(core): fix irq locking in ble driver
[no changelog]
What changed, and why it matters
This is a small bug fix in the Bluetooth driver for Trezor hardware wallets. The code had a path where it returned early without unlocking interrupts, which could leave the device in a state where important background tasks stop running. This could cause the device to freeze or behave unpredictably during Bluetooth communication. There is no direct evidence this was exploited or reported as a security vulnerability.
Apply the patch. Review other interrupt-locking sites in the BLE driver and related I/O code for similar missing unlock paths. Consider static analysis or linting to enforce balanced irq_lock/irq_unlock pairs.
Security signals we found
Missing irq_unlock() on early return path
Interrupt lock leak in BLE driver
Potential firmware deadlock or denial-of-service during BLE I/O
Fix is localized and defensive
Evidence from the diff
In core/embed/io/ble/stm32/ble.c, the ble_read() function takes an irq_lock() at the start and is supposed to irq_unlock(key) before every return path. One early-return branch (returning 0 when read_len is invalid or max_len is too small) was missing the irq_unlock() call. This is a classic interrupt-lock leak: holding the interrupt lock across an early return leaves interrupts disabled, which can deadlock or destabilize the firmware. The patch adds the missing irq_unlock(key) before return 0.
Changed components
core/embed/io/ble/stm32/ble.cTrezor Safe firmware Bluetooth LE driverInterrupt management / RTOS schedulingInspect captured patch +1 / −0
diff --git a/core/embed/io/ble/stm32/ble.c b/core/embed/io/ble/stm32/ble.c
index 918d31d72..0c4b29c25 100644
--- a/core/embed/io/ble/stm32/ble.c
+++ b/core/embed/io/ble/stm32/ble.c
@@ -762,6 +762,7 @@ uint32_t ble_read(uint8_t *data, uint16_t max_len) {
if (read_len != BLE_DATA_SIZE ||
max_len < (read_len - BLE_DATA_HEADER_SIZE)) {
+ irq_unlock(key);
return 0;
}
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.