Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-1822-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Iulia Tanasescu <iulia.tanasescu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: claudia.rosu@nxp.com,
	mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	vlad.pruteanu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Iulia Tanasescu <iulia.tanasescu@nxp.com>
Subject: [PATCH BlueZ 0/1] btdev: Fix set PA data array overflow
Date: Tue, 13 Feb 2024 17:58:02 +0200
Message-Id: <20240213155803.3159-1-iulia.tanasescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?XRRTxdLqxi6ZVCaNvtMwYBAImpPU4mTb3w0Jhuik/osbhm6+T7/ETGHy5KZ+?=
 =?us-ascii?Q?aMF+xIKKDdjnz2sKrTFm61A1Rrmf5fmC2dMGoiVQpyTF4mKVhIvNcZF43XQr?=
 =?us-ascii?Q?tk6F1CEIJn3MHbWAjiUd1EtDHB3cqvxGPa24f1cH2Ab/5fD6FSsr8IIUUd5R?=
 =?us-ascii?Q?Ok16aoutLGAjfGya7qW+Zcv/N8YdazAAsS8iDFcXYi7HEpoaRzGBj0Q9YLym?=
 =?us-ascii?Q?0vHPlwvGh53t47E6PYundLaWJIhSjKThTK9EHTiuDJHAgBsvgXG4KhC9GQTV?=
 =?us-ascii?Q?mLRwGLQHxSaRWcSKvr3cQqWqWPZaPJGlU/Ab6fPEav2QdpuGYId+NHzcyfmA?=
 =?us-ascii?Q?e3VR4kKj5NSLkxaqK/+6KYyCndIlz5zRn4jvNSg9/77dVAGd9VDJN4TbG12B?=
 =?us-ascii?Q?rXkbnU9nskA0yaKbGLN+c0ynj+CAgojDezq+XCduHVXgtDLP0NNWjwQ88c24?=
 =?us-ascii?Q?m2RQhFsRGv4+bjyNqzFGjzXOXv72tGcBRVtq77Rd8IlGuRCLt+jYupo2kRq9?=
 =?us-ascii?Q?E4WLzwSnYGOOzNUpYU+NDZdtgiY5R3rlENrM09sAuBQnNp8I5CqbIa8WMZhx?=
 =?us-ascii?Q?rslpmNHobtuh09TjjXdxNHPNMLYO2i65s/7WEsmTObPAGqyqxvcL5mavNkp3?=
 =?us-ascii?Q?16Wq+wNQsvmZGj2pDlIQBTBzyZRTTK1e2sWI/0lgkwyhNWDqbGIK/e9FLg8d?=
 =?us-ascii?Q?d0Ocf8aP41oW3oKo6VHibE2knAzo7E9XHskIiFPXrWclZgpOPofQG6cAUM2x?=
 =?us-ascii?Q?Y2Slp4QH9GzQtt4fF4lzy1/RvjPDrMO9Wkedv9F1I4aXScTUNz30rj75jcji?=
 =?us-ascii?Q?BQDWwY4sRsD7BjMyAudzXiJ9HVfmfwS3ygKNRkfJNTp6+ge+N9FkaOzyROiU?=
 =?us-ascii?Q?FNlTTPFKcyW5EW2M88Tegk49EnXYPemLLN60Qlyfxq42/KmdA5nGyMq3F7Zi?=
 =?us-ascii?Q?u12fKLp0hBAnVmDOKDBHrgZKygUV7OnT1lAjAHqq+hs0ghcpbQhZMv2oxKyy?=
 =?us-ascii?Q?OESEW1cMSpzWv4ZnnxKiLTYqzvddbtfPyCasgN4Z469RDhY4Uh1ErBulRB4V?=
 =?us-ascii?Q?yEPafMlYr0jO9PE6pUQAcsmueGArswXgUz5krXncqLklb3/RCJjtVPtVo9p2?=
 =?us-ascii?Q?rxrPj5xYteLbaP6vZZ8ZCtZRXiwnQMTm0R0MRH7yvNLAWG17GHInMv+tJqyk?=
 =?us-ascii?Q?bI9U8KrVjw+WF7it4kBGevF9DFoXGeCtFl5cuh5aqJOR14UKcL81Iw34wfno?=
 =?us-ascii?Q?tcpKw82j361Ilpwm4MGwoPiC3zWTV4CzkxUgetOX6xsnGL9ZUWj+BZ6OAdrC?=
 =?us-ascii?Q?oJJn1T1aGXAlmYv3fJcLpT8eFCR9HfRJUqUmT9l1H0dprO2d4medZiMwwjX6?=
 =?us-ascii?Q?hBEzk94wrVnqgCCUR5Bb0KZ0Vp3SW1CV3XTnc/4mlYO9qhfbWMQGJe1ZVhxM?=
 =?us-ascii?Q?hTq3F389QtIUOsVbK12bkPacQX3b0ZMI/l4rBn1CX65Vg8i+PBqPt+/perrE?=
 =?us-ascii?Q?JIrnWZNGJET3LypbVYEzHIKtC2vdIQpGNXJ8KEdWPLZ/1RXQNfLRWhRACiUr?=
 =?us-ascii?Q?JjILKXimXgoMdLXCAI+mCt3eATmp80CSzQ9MwGnieRR10zM4WfXursCwKAM0?=
 =?us-ascii?Q?yQ=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8a249ba4-7377-40a9-f571-08dc2cac932e
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB8898.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Feb 2024 15:58:09.5842
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OmG3yHv/HC5InvmjJlPMHOLW7YkeaJrRb92+8vSR8vnkB5UlTnW2FCVvxLbn9shtaa9jo7C5QpBAf+PGjFth/w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8149

This fixes an array overflow that can happen if the user issues the
LE Set Periodic Advertising Data command with data length exceeding
31 bytes.

This can be noticed when running the Broadcast Source/Sink scenarios
in bluetoothctl, using emulated controllers: If the source BASE
exceeds 31 bytes, the PA reports received by the Sink looks something
like the following:

> HCI Event: LE Meta Event (0x3e) plen 39
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Incomplete, more data to come
        Data length: 0x1f
        25 16 51 18 e0 99 89 01 01 06 00 00 00 00 10 02
        01 03 02 02 01 03 04 28 00 05 03 03 00 00 00

> HCI Event: LE Meta Event (0x3e) plen 15
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Complete
        Data length: 0x07
        00 00 00 00 00 00 00

The second PA report contains invalid bytes that were read outside
the PA data array.

Iulia Tanasescu (1):
  btdev: Fix set PA data array overflow

 emulator/btdev.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)


base-commit: 41c7f3af0352d3e45f4f10b7584e955a7f5cc696
-- 
2.39.2