[PATCH] Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

[PATCH] Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

[Laxman Acharya]

hci_le_per_adv_report_evt() is dispatched with a minimum length of
sizeof(struct hci_ev_le_per_adv_report), which only covers the fixed
part of the event and not the trailing data[] array:

	struct hci_ev_le_per_adv_report {
		__le16   sync_handle;
		__u8     tx_power;
		__u8     rssi;
		__u8     cte_type;
		__u8     data_status;
		__u8     length;
		__u8     data[];
	} __packed;

The handler notifies the ISO layer via hci_proto_connect_ind(), which
reaches iso_connect_ind(). That function retrieves the stored event with
hci_recv_event_data() and, while reassembling the periodic advertising
data, does:

	memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset,
	       ev->data, ev->length);

ev->length is taken directly from the event and is never validated
against the amount of data the event actually carries.  A controller
that reports a length larger than the received event therefore causes
the memcpy() to read past the end of the event buffer.  The leaked bytes
are stored in hcon->le_per_adv_data and can subsequently be read back
from user space via getsockopt(BT_ISO_BASE).

Validate that the event contains ev->length data bytes before it is
consumed, mirroring the check already performed by
hci_le_ext_adv_report_evt() and hci_le_adv_report_evt().

Signed-off-by: Laxman Acharya <acharyalaxman8848@gmail.com>
---
 net/bluetooth/hci_event.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 741d658e9..727545e0c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6604,6 +6604,13 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
 
 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
 
+	/* The reassembly in iso_connect_ind() copies ev->length bytes from the
+	 * stored event, so make sure the event actually carries that many data
+	 * bytes before it is consumed.
+	 */
+	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_PER_ADV_REPORT, ev->length))
+		return;
+
 	hci_dev_lock(hdev);
 
 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, PA_LINK, &flags);
-- 
2.51.2

RE: Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3442 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1140947

---Test result---

Test Summary:
CheckPatch                    PASS      0.76 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       FAIL      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      27.41 seconds
CheckAllWarning               PASS      30.00 seconds
CheckSparse                   PASS      28.64 seconds
BuildKernel32                 PASS      26.48 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      500.72 seconds
TestRunner_l2cap-tester       PASS      63.12 seconds
TestRunner_iso-tester         PASS      82.78 seconds
TestRunner_bnep-tester        PASS      19.41 seconds
TestRunner_mgmt-tester        FAIL      226.06 seconds
TestRunner_rfcomm-tester      PASS      25.61 seconds
TestRunner_sco-tester         PASS      32.32 seconds
TestRunner_ioctl-tester       PASS      26.98 seconds
TestRunner_mesh-tester        FAIL      26.08 seconds
TestRunner_smp-tester         PASS      24.08 seconds
TestRunner_userchan-tester    PASS      20.45 seconds
TestRunner_6lowpan-tester     PASS      23.48 seconds
IncrementalBuild              PASS      25.91 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

7: B3 Line contains hard tab characters (\t): "	struct hci_ev_le_per_adv_report {"
8: B3 Line contains hard tab characters (\t): "		__le16   sync_handle;"
9: B3 Line contains hard tab characters (\t): "		__u8     tx_power;"
10: B3 Line contains hard tab characters (\t): "		__u8     rssi;"
11: B3 Line contains hard tab characters (\t): "		__u8     cte_type;"
12: B3 Line contains hard tab characters (\t): "		__u8     data_status;"
13: B3 Line contains hard tab characters (\t): "		__u8     length;"
14: B3 Line contains hard tab characters (\t): "		__u8     data[];"
15: B3 Line contains hard tab characters (\t): "	} __packed;"
22: B3 Line contains hard tab characters (\t): "	memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset,"
23: B3 Line contains hard tab characters (\t): "	       ev->data, ev->length);"
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 495 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.258 seconds
LL Privacy - Unpair 1                                Timed out    1.875 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.927 seconds
Mesh - Send cancel - 2                               Timed out    1.989 seconds


https://github.com/bluez/bluetooth-next/pull/537

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed,  5 Aug 2026 23:22:01 +0545 you wrote:
> hci_le_per_adv_report_evt() is dispatched with a minimum length of
> sizeof(struct hci_ev_le_per_adv_report), which only covers the fixed
> part of the event and not the trailing data[] array:
> 
> 	struct hci_ev_le_per_adv_report {
> 		__le16   sync_handle;
> 		__u8     tx_power;
> 		__u8     rssi;
> 		__u8     cte_type;
> 		__u8     data_status;
> 		__u8     length;
> 		__u8     data[];
> 	} __packed;
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly
    https://git.kernel.org/bluetooth/bluetooth-next/c/96995a7d94f3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html