[PATCH] Bluetooth: validate retained LE Set Ext Adv Enable command length

[PATCH] Bluetooth: validate retained LE Set Ext Adv Enable command length

[Noah Weinberger]

Hello,

hci_cc_le_set_ext_adv_enable() reads the retained LE Set Extended
Advertising Enable command with hci_sent_cmd_data() and dereferences
set->handle from cp->data whenever cp->num_of_sets != 0, without
checking the retained command's length - the same retained-command
class that was fixed this window for LE Set CIG Parameters
(ed4d302af7) and LE Create CIS (1eb52f35fc).

An injected short command via a raw HCI socket (CAP_NET_RAW) with a
matching Command Complete reads one byte past the retained skb; the
value only selects an advertising instance handle, so the impact is
state confusion rather than memory corruption. The sibling handlers
with the same shape and small fixed-field reads (pin code reply, read
clock, set privacy mode, set per adv params) may deserve the same
treatment.

The patch mirrors the hci_sent_cmd_data_len() + struct_size() pattern
of the two merged fixes.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/bluetooth/hci_event.c:1669-1735 (hci_cc_le_set_ext_adv_enable).
Handler is longstanding; the fix class was established this window by ed4d302af7 (CIG params) and 1eb52f35fc (Create CIS).

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@proton.me>
---
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a525740..7206f3e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1673,14 +1673,17 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
 	struct hci_cp_ext_adv_set *set;
 	struct adv_info *adv = NULL, *n;
 	struct hci_ev_status *rp = data;
+	size_t len;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 
 	if (rp->status)
 		return rp->status;
 
-	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
-	if (!cp)
+	cp = hci_sent_cmd_data_len(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, &len);
+	if (!cp || len < sizeof(*cp) ||
+	    (cp->num_of_sets &&
+	     len < struct_size(cp, data, cp->num_of_sets)))
 		return rp->status;
 
 	set = (void *)cp->data;

RE: Bluetooth: validate retained LE Set Ext Adv Enable command length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3667 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1205518/

---Test result---

Test Summary:
CheckPatch                    FAIL      2.91 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.30 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      30.86 seconds
CheckAllWarning               PASS      35.34 seconds
CheckSparse                   WARNING   37.92 seconds
BuildKernel32                 PASS      30.57 seconds
CheckKernelLLVM               PASS      34.85 seconds
TestRunnerSetup               PASS      743.90 seconds
TestRunner_l2cap-tester       PASS      12.91 seconds
TestRunner_iso-tester         PASS      11.02 seconds
TestRunner_bnep-tester        PASS      3.16 seconds
TestRunner_mgmt-tester        PASS      88.84 seconds
TestRunner_rfcomm-tester      PASS      14.90 seconds
TestRunner_sco-tester         PASS      5.72 seconds
TestRunner_ioctl-tester       PASS      4.72 seconds
TestRunner_mesh-tester        PASS      5.60 seconds
TestRunner_smp-tester         PASS      4.39 seconds
TestRunner_userchan-tester    PASS      3.24 seconds
TestRunner_6lowpan-tester     PASS      4.48 seconds
IncrementalBuild              PASS      29.25 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: validate retained LE Set Ext Adv Enable command length
WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#103: 
Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/bluetooth/hci_event.c:1669-1735 (hci_cc_le_set_ext_adv_enable).

WARNING: Reported-by: should be immediately followed by Closes: or Link: with a URL to the report
#113: 
Reported-by: Noah Weinberger <noahweinberger2003@proton.me>


ERROR: Missing Signed-off-by: line(s)

total: 1 errors, 2 warnings, 0 checks, 19 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14962585.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: validate retained LE Set Ext Adv Enable command length

1: CC1 Body does not contain a 'Signed-off-by' line
23: B1 Line exceeds max length (166>80): "Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/bluetooth/hci_event.c:1669-1735 (hci_cc_le_set_ext_adv_enable)."
24: B1 Line exceeds max length (122>80): "Handler is longstanding; the fix class was established this window by ed4d302af7 (CIG params) and 1eb52f35fc (Create CIS)."
27: B1 Line exceeds max length (124>80): "mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the"
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):


https://github.com/bluez/bluetooth-next/pull/1090

---
Regards,
Linux Bluetooth