[PATCH v2 0/2] Bluetooth: ISO: backport missed OOB write fix to 6.6.y and 6.1.y

[Jeremy Erazo (Devel Group)]

From: Jeremy Erazo <mendozayt13@xxxxxxxxx>

Hi Greg, Sasha, Luiz,

v2 respin.  Two things fixed vs v1:

  * The 40-char upstream SHA I put in the "commit <sha> upstream." line
    of both patches was garbage.  The 12-char prefix f4da3ee15de9 was
    correct but I hand-expanded the tail wrong, so `git cat-file` on it
    fails.  Corrected to f4da3ee15de9944482382181329bb6d7335ca003.
    Thanks Sasha for catching that.

  * The v1 patches were asymmetric: 6.6.y accidentally carried the
    put_user() hunk in iso_sock_getsockopt() that 6.1.y omitted.  There
    was no reason for that split; my mistake in v1.  v2 drops the
    put_user hunk from 6.6.y so both branches now carry identical
    mechanics against their own net/bluetooth/iso.c (add #include
    "eir.h", add EIR_BAA_SERVICE_UUID define, replace the memcpy() with
    the eir_get_service_data() + bounds-check pattern).  The put_user()
    correction is a separate getsockopt correctness fix; if that hunk
    is wanted in stable it should travel as its own patch.

Everything else in v1 still stands: root cause, affected branch matrix,
reachability, build verification.  Re-stated below for the archive.

Root cause: upstream commit f4da3ee15de9944482382181329bb6d7335ca003
("Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID",
2023-09-28, mainline v6.7) addressed the OOB write in iso_connect_ind()
but landed without a Fixes: tag, so the stable autoselect bot never
picked it up.  linux-6.6.y (v6.6.143) and linux-6.1.y (v6.1.176) both
still ship the pre-fix code where ev3->length, a __u8 in [0, 255],
drives memcpy() directly into iso_pi(sk)->base[248].  Values in
[249, 255] overflow 1 to 7 bytes into adjacent fields of struct
iso_pinfo, including the low bytes of iso_pi(sk)->conn.  FORTIFY_SOURCE
flags the write but does not block it.

Affected branch matrix (as of today, 2026-07-07):

  * linux-6.6.y  (v6.6.143)  vulnerable  - patch 1/2
  * linux-6.1.y  (v6.1.176)  vulnerable  - patch 2/2
  * linux-5.15.y            NOT affected  - iso_connect_ind PA-report
                                            handling was introduced by
                                            commit 9c0826310bfb in v6.5,
                                            after 5.15.y branched.

Both patches carry the same three hunks against their own iso.c:

  * add #include "eir.h"
  * add #define EIR_BAA_SERVICE_UUID 0x1851
  * replace the unbounded memcpy() with the upstream pattern
    (eir_get_service_data() + base_len <= sizeof(iso_pi(sk)->base) guard)

Reachability of the underlying bug: any host with an ISO listening
socket bound as a broadcast sink (LE Audio / Auracast use case).  No
pairing required, single HCI_EV_LE_PER_ADV_REPORT event within BLE
radio range.

Build verification: net/bluetooth/iso.o builds cleanly in both trees
with BT + BT_LE + BT_HCIVHCI enabled on x86_64 defconfig.  No new
checkpatch errors; two warnings reported are "unknown commit id"
(shallow clone) and one long line in the backport-note paragraph.

I did not include a reproducer or PoC in this series because the fix
is the one Luiz/Claudia already landed upstream and there is no dispute
about the OOB write.  A userspace reproducer against /dev/vhci exists
locally and is available on request if the maintainers want to confirm
on their side.

Changes in v2:
  * Fix incorrect 40-char upstream SHA in the "upstream." line of both
    patches (thanks Sasha).
  * Drop the getsockopt put_user() hunk from 6.6.y so both patches are
    symmetric.

Jeremy Erazo (2):
  Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
  Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

 net/bluetooth/iso.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

--
2.53.0