Re: [PATCH] Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Tue, 31 Mar 2026 05:39:16 +0000 you wrote:
> hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
> struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
> BIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
> entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
> hci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,
> the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
> past the stack buffer, corrupting adjacent stack memory.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
    https://git.kernel.org/bluetooth/bluetooth-next/c/4797dfba1aa5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html