Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
Subsystems (3)
PATCH 1/1 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory.
This is trivially reproducible: binding an ISO socket with bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will eventually trigger hci_le_big_create_sync() from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write:
BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71
Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that conn->bis can actually carry.
--- net/bluetooth/hci_sync.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/hci_sync.c +2 -1
@@ -7222,7 +7222,8 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)static int hci_le_big_create_sync (struct hci_dev *hdev,void *data) { - DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 0x11); + DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, + HCI_MAX_ISO_BIS);struct hci_conn *conn = data;struct bt_iso_qos *qos = &conn->iso_qos;int err;
Signature · 1 line
2.51.0
Dear hkbinbin,
Thank you for your patch. It’d be great if you spelt your name with capital letters and spaces (git config --global user.name "…").
Am 31.03.26 um 07:39 schrieb hkbinbin:
Quoted 10 lines
hci_le_big_create_sync()usesDEFINE_FLEXto allocate a structhci_cp_le_big_create_syncon the stack with room for0x11(17) BIS entries. However,conn->num_biscan hold up toHCI_MAX_ISO_BIS(31) entries — validated againstISO_MAX_NUM_BIS(0x1f) in the callerhci_conn_big_create_sync(). Whenconn->num_bisis between 18 and 31, the memcpy that copiesconn->bisintocp->biswrites up to 14 bytes past the stack buffer, corrupting adjacent stack memory.This is trivially reproducible: binding an ISO socket with
bc_num_bis=ISO_MAX_NUM_BIS(31) and callinglisten()will
If this is not more than twenty lines, maybe share the program/script?
Quoted 11 lines
eventually trigger
hci_le_big_create_sync()from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write:BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71Fix this by changing the
DEFINE_FLEXcount from the incorrect0x11toHCI_MAX_ISO_BIS, which matches the maximum number of BIS entries thatconn->biscan actually carry.Fixes 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending")
Just for the record, that the commit is present since Linux v6.13-rc1.
Quoted 11 lines
Signed-off-by hkbinbin <[email protected]>--- net/bluetooth/hci_sync.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)net/bluetooth/hci_sync.c +0
-0
net/bluetooth/hci_sync.c static void create_big_complete(struct hci_dev *hdev, void *data, int err) · line 7229
Quoted 9 lines
net/bluetooth/hci_sync.c +2
-1@@ -7222,7 +7222,8 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)static int hci_le_big_create_sync (struct hci_dev *hdev,void *data) { - DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 0x11); + DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, + HCI_MAX_ISO_BIS);struct hci_conn *conn = data;struct bt_iso_qos *qos = &conn->iso_qos;int err;
The diff looks good. Great find.
Kind regards,
Paul
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1074953
---Test result---
Test Summary:
CheckPatch PENDING 0.28 seconds GitLint PENDING 0.25 seconds SubjectPrefix PASS 0.12 seconds BuildKernel PASS 26.85 seconds CheckAllWarning PASS 29.24 seconds CheckSparse PASS 27.93 seconds BuildKernel32 PASS 25.87 seconds TestRunnerSetup PASS 577.11 seconds TestRunner_l2cap-tester PASS 28.50 seconds TestRunner_iso-tester PASS 43.01 seconds TestRunner_bnep-tester PASS 6.46 seconds TestRunner_mgmt-tester FAIL 114.42 seconds TestRunner_rfcomm-tester PASS 9.60 seconds TestRunner_sco-tester FAIL 14.70 seconds TestRunner_ioctl-tester PASS 10.69 seconds TestRunner_mesh-tester FAIL 12.45 seconds TestRunner_smp-tester PASS 8.84 seconds TestRunner_userchan-tester PASS 6.81 seconds IncrementalBuild PENDING 0.65 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.109 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.719 seconds Mesh - Send cancel - 2 Timed out 1.995 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series Output:
---
Regards,
Linux Bluetooth
This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>:
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>:
Quoted 9 lines · On Tue, 31 Mar 2026 05:39:16 +0000 you wrote:
hci_le_big_create_sync()usesDEFINE_FLEXto allocate a structhci_cp_le_big_create_syncon the stack with room for0x11(17) BIS entries. However,conn->num_biscan hold up toHCI_MAX_ISO_BIS(31) entries — validated againstISO_MAX_NUM_BIS(0x1f) in the callerhci_conn_big_create_sync(). Whenconn->num_bisis between 18 and 31, the memcpy that copiesconn->bisintocp->biswrites up to 14 bytes past the stack buffer, corrupting adjacent stack memory.[...]
Here is the summary with links:
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
https://git.kernel.org/bluetooth/bluetooth-next/c/4797dfba1aa5
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html