[PATCH] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt

[hkbinbin <hkbinbinbin@gmail.com>]

hci_le_create_big_complete_evt() iterates over BT_BOUND connections
for a BIG handle using a while loop, accessing ev->bis_handle[i++]
on each iteration.  However, there is no check that i < ev->num_bis
before the array access.

When a controller sends a LE_Create_BIG_Complete event with num_bis=0
while BT_BOUND connections exist for that BIG handle, the loop reads
beyond the valid bis_handle[] entries into adjacent heap memory.
Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX
(0x0EFF), hci_conn_set_handle() rejects them and the connection
remains in BT_BOUND state.  The same connection is then found again
by hci_conn_hash_lookup_big_state(), creating an infinite loop with
hci_dev_lock held that blocks all Bluetooth operations:

  Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
  Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
  ... (repeats ~177 times)
  Bluetooth: hci0: Opcode 0x2040 failed: -110
  Bluetooth: hci0: command 0x2040 tx timeout

The value 0x6b6b is the KASAN slab free poison byte (0x6b),
confirming reads of freed/uninitialized heap memory.

Fix this by adding a bounds check on i against ev->num_bis before
accessing the array.  Connections beyond the reported count are
cleaned up with HCI_ERROR_UNSPECIFIED to prevent the infinite loop.

Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: hkbinbin <hkbinbinbin@gmail.com>
---
 net/bluetooth/hci_event.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 286529d2e554..ebd7ae75b133 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -7085,6 +7085,12 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
 			continue;
 		}
 
+		if (i >= ev->num_bis) {
+			hci_connect_cfm(conn, HCI_ERROR_UNSPECIFIED);
+			hci_conn_del(conn);
+			continue;
+		}
+
 		if (hci_conn_set_handle(conn,
 					__le16_to_cpu(ev->bis_handle[i++])))
 			continue;
-- 
2.51.0