[PATCH 0/2] Bluetooth: validate retained LE ISO command lengths

[PATCH 0/2] Bluetooth: validate retained LE ISO command lengths

[Yifan Zhang]

Two LE ISO event handlers use flexible-array data from the retained command
skb without checking how much command data is present.  A malformed command
can therefore make either handler read beyond the skb when the controller
returns its status or completion event.

Add a saved-command helper that also returns the parameter length, then
use it to validate LE Create CIS and LE Set CIG Parameters commands before
their CIS arrays are accessed.

Yifan Zhang (2):
  Bluetooth: validate retained LE Create CIS command length
  Bluetooth: validate retained LE Set CIG Parameters command length

 include/net/bluetooth/hci_core.h |  2 ++
 net/bluetooth/hci_core.c         | 18 ++++++++++++++----
 net/bluetooth/hci_event.c        | 14 +++++++++++---
 3 files changed, 27 insertions(+), 7 deletions(-)

-- 
2.39.5 (Apple Git-154)

[PATCH 1/2] Bluetooth: validate retained LE Create CIS command length

[Yifan Zhang]

hci_cs_le_create_cis() retrieves the parameters of the previously sent
command without their length.  It then trusts num_cis and walks the
flexible cis[] array when a controller reports a failed command.

A five-byte HCI command containing only num_cis can therefore make the
handler read beyond the command skb.  KASAN reports:

  BUG: KASAN: slab-out-of-bounds in hci_cs_le_create_cis
  Read of size 2
  hci_cs_le_create_cis
  hci_cmd_status_evt
  hci_event_packet

Add a length-returning saved-command helper and require the fixed header
and complete CIS array before walking it.

The reproducer no longer triggers a KASAN report with this change.

Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
Closes: https://lore.kernel.org/linux-bluetooth/179317462624.87574.6271582002629080499@stu.pku.edu.cn/
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
 include/net/bluetooth/hci_core.h |  2 ++
 net/bluetooth/hci_core.c         | 18 ++++++++++++++----
 net/bluetooth/hci_event.c        |  7 ++++++-
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index aa04dec451534..dfeae27250ea9 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2426,6 +2426,8 @@ void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
 void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb);
 
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode);
+void *hci_sent_cmd_data_len(struct hci_dev *hdev, __u16 opcode,
+			    size_t *len);
 void *hci_recv_event_data(struct hci_dev *hdev, __u8 event);
 
 u32 hci_conn_get_phy(struct hci_conn *conn);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 209244fd93918..25ab26dab5cca 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3159,7 +3159,8 @@ int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
 EXPORT_SYMBOL(__hci_cmd_send);
 
 /* Get data from the previously sent command */
-static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
+static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode,
+			  size_t *len)
 {
 	struct hci_command_hdr *hdr;
 
@@ -3171,23 +3172,32 @@ static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
 	if (hdr->opcode != cpu_to_le16(opcode))
 		return NULL;
 
+	if (len)
+		*len = skb->len - HCI_COMMAND_HDR_SIZE;
+
 	return skb->data + HCI_COMMAND_HDR_SIZE;
 }
 
 /* Get data from the previously sent command */
-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+void *hci_sent_cmd_data_len(struct hci_dev *hdev, __u16 opcode, size_t *len)
 {
 	void *data;
 
 	/* Check if opcode matches last sent command */
-	data = hci_cmd_data(hdev->sent_cmd, opcode);
+	data = hci_cmd_data(hdev->sent_cmd, opcode, len);
 	if (!data)
 		/* Check if opcode matches last request */
-		data = hci_cmd_data(hdev->req_skb, opcode);
+		data = hci_cmd_data(hdev->req_skb, opcode, len);
 
 	return data;
 }
 
+/* Get data from the previously sent command */
+void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+{
+	return hci_sent_cmd_data_len(hdev, opcode, NULL);
+}
+
 /* Get data from last received event */
 void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
 {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1f80f2cf6b2c8..8dc632329aeb5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4481,6 +4481,7 @@ static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
 {
 	struct hci_cp_le_create_cis *cp;
 	bool pending = false;
+	size_t len;
 	int i;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
@@ -4488,10 +4489,14 @@ static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
 	if (!status)
 		return;
 
-	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
+	cp = hci_sent_cmd_data_len(hdev, HCI_OP_LE_CREATE_CIS, &len);
 	if (!cp)
 		return;
 
+	if (len < sizeof(*cp) ||
+	    len < struct_size(cp, cis, cp->num_cis))
+		return;
+
 	hci_dev_lock(hdev);
 
 	/* Remove connection if command failed */
-- 
2.39.5 (Apple Git-154)

[PATCH 2/2] Bluetooth: validate retained LE Set CIG Parameters command length

[Yifan Zhang]

hci_cc_le_set_cig_params() validates the controller response but not the
parameters of the previously sent command.  A short command can claim a
large num_cis without containing the corresponding cis[] array.  A
complete successful response then makes the handler read beyond the
command skb while looking up each CIS ID.

KASAN reports:

  BUG: KASAN: slab-out-of-bounds in hci_cc_le_set_cig_params
  Read of size 1
  hci_cc_le_set_cig_params
  hci_cmd_complete_evt
  hci_event_packet

Obtain the retained parameter length and require both the fixed header and
the complete CIS array before using the command data.

The reproducer no longer triggers a KASAN report with this change.

Fixes: 71e9588435c3 ("Bluetooth: ISO: use correct CIS order in Set CIG Parameters event")
Closes: https://lore.kernel.org/linux-bluetooth/179317463153.87610.8996555110609321376@stu.pku.edu.cn/
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
 net/bluetooth/hci_event.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8dc632329aeb5..62229d3b0b33f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3975,13 +3975,16 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
 	struct hci_conn *conn;
 	u8 status = rp->status;
 	bool pending = false;
+	size_t len;
 	int i;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 
-	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
+	cp = hci_sent_cmd_data_len(hdev, HCI_OP_LE_SET_CIG_PARAMS, &len);
 	if (!rp->status &&
-	    (!cp || rp->num_handles != cp->num_cis ||
+	    (!cp || len < sizeof(*cp) ||
+	     len < struct_size(cp, cis, cp->num_cis) ||
+	     rp->num_handles != cp->num_cis ||
 	     rp->cig_id != cp->cig_id ||
 	     skb->len < array_size(rp->num_handles, sizeof(*rp->handle)))) {
 		bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
-- 
2.39.5 (Apple Git-154)

RE: Bluetooth: validate retained LE ISO command lengths

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3545 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1198784/

---Test result---

Test Summary:
CheckPatch                    PASS      1.37 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.54 seconds
SubjectPrefix                 PASS      0.16 seconds
BuildKernel                   PASS      24.95 seconds
CheckAllWarning               PASS      28.00 seconds
CheckSparse                   WARNING   29.42 seconds
BuildKernel32                 PASS      24.60 seconds
CheckKernelLLVM               PASS      25.20 seconds
TestRunnerSetup               PASS      572.25 seconds
TestRunner_l2cap-tester       FAIL      11.69 seconds
TestRunner_iso-tester         PASS      13.77 seconds
TestRunner_bnep-tester        PASS      2.77 seconds
TestRunner_mgmt-tester        PASS      84.55 seconds
TestRunner_rfcomm-tester      PASS      4.25 seconds
TestRunner_sco-tester         PASS      5.08 seconds
TestRunner_ioctl-tester       PASS      4.20 seconds
TestRunner_mesh-tester        PASS      5.10 seconds
TestRunner_smp-tester         PASS      3.98 seconds
TestRunner_userchan-tester    PASS      3.41 seconds
TestRunner_6lowpan-tester     PASS      4.04 seconds
IncrementalBuild              PASS      27.26 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==35==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bbc644e33d0 at pc 0x55c39ff30e8e bp 0x7ffd38a4a0c0 sp 0x7ffd38a4a0b0
READ of size 4 at 0x7bbc644e33d0 thread T0
    #0 0x55c39ff30e8d in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x55c39ff31b75 in timeout_callback src/shared/mainloop.c:270
    #2 0x55c39ff32aa6 in mainloop_run src/shared/mainloop.c:124
    #3 0x55c39ff353fa in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x55c39ff3a64b in tester_run src/shared/tester.c:1223
    #5 0x55c39fe6417d in main tools/l2cap-tester.c:3918
    #6 0x7f7c65443600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f7c65443717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x55c39fe6ac84 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16cc84) (BuildId: 91c9d49e9766c394468e27ffa29b05e7d348169f)

0x7bbc644e33d0 is located 0 bytes inside of 40-byte region [0x7bbc644e33d0,0x7bbc644e33f8)
freed by thread T0 here:
    #0 0x7f7c65d813ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x55c39ff3136a in timeout_destroy src/shared/mainloop.c:251

previously allocated by thread T0 here:
    #0 0x7f7c65d8260f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x55c39ff1b2d5 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1041

---
Regards,
Linux Bluetooth

Re: [PATCH 0/2] Bluetooth: validate retained LE ISO command lengths

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 02 Nov 2026 19:58:37 +0800 you wrote:
> Two LE ISO event handlers use flexible-array data from the retained command
> skb without checking how much command data is present.  A malformed command
> can therefore make either handler read beyond the skb when the controller
> returns its status or completion event.
> 
> Add a saved-command helper that also returns the parameter length, then
> use it to validate LE Create CIS and LE Set CIG Parameters commands before
> their CIS arrays are accessed.
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: validate retained LE Create CIS command length
    https://git.kernel.org/bluetooth/bluetooth-next/c/1eb52f35fc8f
  - [2/2] Bluetooth: validate retained LE Set CIG Parameters command length
    https://git.kernel.org/bluetooth/bluetooth-next/c/ed4d302af778

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html