From ed4d302af778b9e2ead28134a2196c09a4ad248a Mon Sep 17 00:00:00 2001 From: Yifan Zhang Date: Mon, 2 Nov 2026 19:58:37 +0800 Subject: [PATCH] Bluetooth: validate retained LE Set CIG Parameters command length hci_cc_le_set_cig_params() validates the controller response but not the parameters of the previously sent command. A short command can claim a large num_cis without containing the corresponding cis[] array. A complete successful response then makes the handler read beyond the command skb while looking up each CIS ID. KASAN reports: BUG: KASAN: slab-out-of-bounds in hci_cc_le_set_cig_params Read of size 1 hci_cc_le_set_cig_params hci_cmd_complete_evt hci_event_packet Obtain the retained parameter length and require both the fixed header and the complete CIS array before using the command data. The reproducer no longer triggers a KASAN report with this change. Fixes: 71e9588435c3 ("Bluetooth: ISO: use correct CIS order in Set CIG Parameters event") Closes: https://lore.kernel.org/linux-bluetooth/179317463153.87610.8996555110609321376@stu.pku.edu.cn/ Signed-off-by: Yifan Zhang Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/hci_event.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index bb4249f8e665..377e916ccacc 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -3985,13 +3985,16 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data, struct hci_conn *conn; u8 status = rp->status; bool pending = false; + size_t len; int i; bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); - cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS); + cp = hci_sent_cmd_data_len(hdev, HCI_OP_LE_SET_CIG_PARAMS, &len); if (!rp->status && - (!cp || rp->num_handles != cp->num_cis || + (!cp || len < sizeof(*cp) || + len < struct_size(cp, cis, cp->num_cis) || + rp->num_handles != cp->num_cis || rp->cig_id != cp->cig_id || skb->len < array_size(rp->num_handles, sizeof(*rp->handle)))) { bt_dev_err(hdev, "unexpected Set CIG Parameters response data");