From nobody Sat Aug 1 21:31:28 2026 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3B1335676A for ; Sat, 1 Aug 2026 18:09:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785607800; cv=none; b=Btv7BixPB9uMjwUHLyg3oWLCuZbwIDae1pISvKgH5yYuY1BT3zBv0epntv25bGfx97bE/gMrfLBhzaQoO5QCul6re1tb9KaiuaOSl+P5CHxW+Xyy1w4WwK53VXkrBDLLalMNsK6SKIMizonI3pEBekcCEvz0ZbXR6S3ra0ybFoY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785607800; c=relaxed/simple; bh=WEcjtcqDNZS7fanXu6IxpCAayUzbMvypPt8/LGV6H1w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=D3L+YolWMNY79PMWQKkYFDaOUbglstKMIYhU+eY/L2a0iYTS0dDsebKMSS5au9Kp9lfow3Wd3VgRLxkXHVY6nNxohIG7GQKZvbb40r0NnDO/W1X/DjGBGaGXG73QPzUPgvLH4OX4bkzApqZXgJUGg2VCVdooAYcjtSc1RCoU+8Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UrYPViOF; arc=none smtp.client-ip=209.85.215.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UrYPViOF" Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cbb662575d3so1152863a12.0 for ; Sat, 01 Aug 2026 11:09:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785607798; x=1786212598; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=6O0fpU3QwDSXR0C6so4bTXrLoipUitFQ1pdNs7HEMwk=; b=UrYPViOFaXiGV6t8VJmrOPE2hud7yOB4Us3HBuUxlsUsRKcve/JErNuJuYubryZeBe YHmRHYstLVdeB4ZuK2zxGzgWiMAFq1xhSIp42ucPCSxMpv1TKUR6F4iTSdRDWvyvExBt ONsI6K7jDnaFkiGonq5aoD/TfCfcQjzpLHzh37aTQSKJxLGsN+/T+/KjiXNuh2xeUAja J2Sb0uw8IR5zml8BM+oDx4L1jkBk4GSWMXR2555BJlYi7e1ndl3y8R38/TFp5ir+bP73 zc3R1dbTKsrDLY7fiaPf/8b0h+9J+XWoYgq9pz439gV3B4qIJpMHfgxYDrwIZ8MRqWK4 Vfzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785607798; x=1786212598; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6O0fpU3QwDSXR0C6so4bTXrLoipUitFQ1pdNs7HEMwk=; b=tVj0khPc+aH8cNSpTr/heI4STo6RaZTtLBnis6LDHuoCcgJOxfMxLt5oaSTnG/ABI0 4kA6WEirmm1v1HbZtZ0aT5r5DtQF4Z0LVdU42LUE2Yj94096ZanLdYiJJGBO1fph3HhX o30nUa/VAdk3hQE+Y0YPSNDtlBE0BlHbxlZLiZsNXlU4cvCBVJdjPE4GJutXNjuBzvPQ AQL9K2i1hq/VLnyZ+lDU54tw9ZRs0GqXNef/jhSSXw3vO488d14OVG2rtEn4syyYglIT vBRJh1ZCHkCR/TtLJtILHuuNW6Xe2Jj14KdtswOfcQa3Eq5khxVQf8y6hR8rCi3vhPwL rbFg== X-Forwarded-Encrypted: i=1; AHgh+Ro9EwiDHX7munTWvIXUeEpn+nGPbkQLaVhYeieFUKthHFvCgGbXK3w2HWLnReRZSIGMWHNDu0THH8VkkOU=@vger.kernel.org X-Gm-Message-State: AOJu0YwngubyW2k2V21vGARIXMlg9opy5V1u6JypEP8Pw90SoB7AnD4P HKbvCpGNlOJqUBHeFb1dOlPp8+98icwVx1teGSFiZbvLKIvEmi6qWzhN X-Gm-Gg: AR+sD13s3T6Hm3PLdzgysep4rkckq1Me8DhUD88bGtaqtm7quP6w6xxtiXSqgHMicks GecCUbpCTEDEu5mBqy78fIzMh+Mm4EGFkhBrueYqYBaIgLjoGpisy9AEr9WG8VTc5qDP0ZpUS3c rsJdTzO62IrL99M18da5yTdcuv7hhUx5gsd3anNP5ApA2tvQ9+VS1lLqmt1XQh15CWD57eLifp5 3eDeBta7Gy4i995XrLCbV32SgOoybTiNGsI5ymMZjFKYU9WmAHJ5uhI7FA/gMMveXRjoHFzNT3C vWbAnudU9r6i602kszVYP0nSPcdosLgjfHtb/F41rwQWd7m/TjZgA9nZrXmpmzyyzTJfFi9IDyH 93eYY6SWg3P9QOdCvy4fdnVa08/1RKHGBuSymOu6Xsp/qSW7JZEPHtE5kG2C7RnFTZKS46EM8Zn jJLxCkH0ReaFLOc6/JXZmMRV1G8VdlfmlVBrAlGklxm2ZkAfh/0ZfJbQjFCvUYjn5n6Qe8Dac0w ZYzw1yCWO1pj0Sdcw/M2kvZzSKBFZ56xWQhihdts8b5hLK2P5rf63R/gZeX9XKhcX9UWyam9uSe lNNb1SEn3PO6DMOMhfE= X-Received: by 2002:a05:6a21:1798:b0:3c3:c130:3532 with SMTP id adf61e73a8af0-3c92a9c16fdmr3674481637.41.1785607798104; Sat, 01 Aug 2026 11:09:58 -0700 (PDT) Received: from localhost.localdomain ([2405:acc0:1306:9d5b:7865:f907:f2bf:8664]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3153e18e70esm34428797eec.29.2026.08.01.11.09.55 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 01 Aug 2026 11:09:57 -0700 (PDT) From: Laxman Acharya Padhya To: Marcel Holtmann , Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] Bluetooth: hci_event: validate LE Set CIG Parameters response Date: Sat, 1 Aug 2026 23:54:52 +0545 Message-ID: <20260801180952.52072-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array. Matching num_handles against the command's num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data. Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connecti= ons") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 741d658e9..fc6ce00f6 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -3827,8 +3827,10 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *h= dev, void *data, bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); =20 cp =3D hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS); - if (!rp->status && (!cp || rp->num_handles !=3D cp->num_cis || - rp->cig_id !=3D cp->cig_id)) { + if (!rp->status && + (!cp || rp->num_handles !=3D cp->num_cis || + rp->cig_id !=3D cp->cig_id || + skb->len < array_size(rp->num_handles, sizeof(*rp->handle)))) { bt_dev_err(hdev, "unexpected Set CIG Parameters response data"); status =3D HCI_ERROR_UNSPECIFIED; } --=20 2.51.2