Re: [PATCH] Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

patchwork-bot+bluetooth
2026-03-31T14:30:24Z

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 31 Mar 2026 05:39:16 +0000 you wrote:
> hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
> struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
> BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
> entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
> hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31,
> the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
> past the stack buffer, corrupting adjacent stack memory.
>
> [...]

Here is the summary with links:
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
https://git.kernel.org/bluetooth/bluetooth-next/c/4797dfba1aa5

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.