[PATCH 0/2] Bluetooth: validate retained LE ISO command lengths

[Yifan Zhang]

Two LE ISO event handlers use flexible-array data from the retained command
skb without checking how much command data is present.  A malformed command
can therefore make either handler read beyond the skb when the controller
returns its status or completion event.

Add a saved-command helper that also returns the parameter length, then
use it to validate LE Create CIS and LE Set CIG Parameters commands before
their CIS arrays are accessed.

Yifan Zhang (2):
  Bluetooth: validate retained LE Create CIS command length
  Bluetooth: validate retained LE Set CIG Parameters command length

 include/net/bluetooth/hci_core.h |  2 ++
 net/bluetooth/hci_core.c         | 18 ++++++++++++++----
 net/bluetooth/hci_event.c        | 14 +++++++++++---
 3 files changed, 27 insertions(+), 7 deletions(-)

-- 
2.39.5 (Apple Git-154)