Re: [PATCH] Bluetooth: hci_event: fix OOB read and infinite loop in hci_le_create_big_complete_evt

[Luiz Augusto von Dentz]

Hi Hkbinbin,

On Tue, Mar 31, 2026 at 1:50 AM hkbinbin <hkbinbinbin@xxxxxxxxx> wrote:
>
> hci_le_create_big_complete_evt() iterates over BT_BOUND connections
> for a BIG handle using a while loop, accessing ev->bis_handle[i++]
> on each iteration.  However, there is no check that i < ev->num_bis
> before the array access.
>
> When a controller sends a LE_Create_BIG_Complete event with num_bis=0
> while BT_BOUND connections exist for that BIG handle, the loop reads
> beyond the valid bis_handle[] entries into adjacent heap memory.
> Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX
> (0x0EFF), hci_conn_set_handle() rejects them and the connection
> remains in BT_BOUND state.  The same connection is then found again
> by hci_conn_hash_lookup_big_state(), creating an infinite loop with
> hci_dev_lock held that blocks all Bluetooth operations:
>
>   Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
>   Bluetooth: hci0: Invalid handle: 0x6b6b > 0x0eff
>   ... (repeats ~177 times)
>   Bluetooth: hci0: Opcode 0x2040 failed: -110
>   Bluetooth: hci0: command 0x2040 tx timeout
>
> The value 0x6b6b is the KASAN slab free poison byte (0x6b),
> confirming reads of freed/uninitialized heap memory.
>
> Fix this by adding a bounds check on i against ev->num_bis before
> accessing the array.  Connections beyond the reported count are
> cleaned up with HCI_ERROR_UNSPECIFIED to prevent the infinite loop.
>
> Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: hkbinbin <hkbinbinbin@xxxxxxxxx>
> ---
>  net/bluetooth/hci_event.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 286529d2e554..ebd7ae75b133 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -7085,6 +7085,12 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
>                         continue;
>                 }
>
> +               if (i >= ev->num_bis) {
> +                       hci_connect_cfm(conn, HCI_ERROR_UNSPECIFIED);
> +                       hci_conn_del(conn);
> +                       continue;
> +               }

https://sashiko.dev/#/patchset/20260331055032.1883139-1-hkbinbinbin%40gmail.com

Actually we might want to consider that all BISes failed if something
like this happens, so perhaps we should break and terminate if i !=
ev->num_bis


>                 if (hci_conn_set_handle(conn,
>                                         __le16_to_cpu(ev->bis_handle[i++])))
>                         continue;
> --
> 2.51.0
>


-- 
Luiz Augusto von Dentz