Re: [PATCH 0/2] Bluetooth: validate retained LE ISO command lengths

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Mon, 02 Nov 2026 19:58:37 +0800 you wrote:
> Two LE ISO event handlers use flexible-array data from the retained command
> skb without checking how much command data is present.  A malformed command
> can therefore make either handler read beyond the skb when the controller
> returns its status or completion event.
> 
> Add a saved-command helper that also returns the parameter length, then
> use it to validate LE Create CIS and LE Set CIG Parameters commands before
> their CIS arrays are accessed.
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: validate retained LE Create CIS command length
    https://git.kernel.org/bluetooth/bluetooth-next/c/1eb52f35fc8f
  - [2/2] Bluetooth: validate retained LE Set CIG Parameters command length
    https://git.kernel.org/bluetooth/bluetooth-next/c/ed4d302af778

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html