Re: [PATCH v2 1/2 6.6.y] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Jul 07, 2026 at 10:05:25PM +0000, Jeremy Erazo (Devel Group) wrote:
> From: Jeremy Erazo <mendozayt13@gmail.com>
> 
> commit f4da3ee15de9944482382181329bb6d7335ca003 upstream.
> 
> Copy the content of a Periodic Advertisement Report to BASE only if
> the service UUID is Basic Audio Announcement Service UUID.
> 
> [Stable backport rationale]
> 
> This fix landed in mainline v6.7 without a Fixes: tag, so the stable
> autoselect bot never picked it up.  linux-6.6.y HEAD (v6.6.143) still
> carries the pre-fix code at net/bluetooth/iso.c:1935:
> 
> 	if (sk) {
> 		memcpy(iso_pi(sk)->base, ev3->data, ev3->length);
> 		iso_pi(sk)->base_len = ev3->length;
> 	}
> 
> ev3->length is __u8 and iso_pi(sk)->base is __u8[BASE_MAX_LENGTH] where
> BASE_MAX_LENGTH is HCI_MAX_PER_AD_LENGTH(252) - EIR_SERVICE_DATA_LENGTH(4)
> = 248.  When an attacker within BLE radio range sends an HCI_EV_LE_PER_ADV_REPORT
> with ev3->length in [249, 255], the memcpy writes 1 to 7 bytes past the
> buffer into the trailing fields of struct iso_pinfo, including the low
> bytes of the iso_pi(sk)->conn pointer.  FORTIFY_SOURCE flags the write
> with "memcpy: detected field-spanning write" but does not block it.
> 
> The upstream refactor addresses this by:
>   1. Filtering via eir_get_service_data() so only the BASE portion of
>      the PA payload is copied.
>   2. Bounding the copy with base_len <= sizeof(iso_pi(sk)->base).
> 
> Backport notes for 6.6.y:
>   * eir_get_service_data() is already declared in net/bluetooth/eir.h.
>   * The header include for eir.h and the EIR_BAA_SERVICE_UUID define
>     are added here, matching the upstream commit.
>   * The put_user() addition in iso_sock_getsockopt() that was part of
>     the same upstream commit is not included; that hunk is a separate
>     getsockopt correctness fix and is not required for the OOB write
>     fix (getsockopt(BT_ISO_BASE) is a controlled path that already
>     validates optlen against sizeof(iso_pi(sk)->base)).  Applying the
>     getsockopt hunk here would risk a user-visible ABI change on a
>     stable branch.
> 
> Reachability: any host with an ISO listening socket bound as a
> broadcast sink (LE Audio / Auracast).  No pairing required.
> 
> Fixes: 9c0826310bfb ("Bluetooth: ISO: Add support for periodic adv reports processing")
> Cc: stable@vger.kernel.org # 6.6.y
> Signed-off-by: Claudia Draghicescu <claudia.rosu@nxp.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> [jerazo: backport to 6.6.y; add #include "eir.h" and EIR_BAA_SERVICE_UUID define; drop unrelated getsockopt hunk]

But eir.h was included in the original commit, you added it in a
different place from the original, why?  Please try to keep changes as
close to upstream as possible when backporting.

Please fix this up and resend.

thanks,

greg k-h