Re: [PATCH] Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Wed,  5 Aug 2026 23:22:01 +0545 you wrote:
> hci_le_per_adv_report_evt() is dispatched with a minimum length of
> sizeof(struct hci_ev_le_per_adv_report), which only covers the fixed
> part of the event and not the trailing data[] array:
> 
> 	struct hci_ev_le_per_adv_report {
> 		__le16   sync_handle;
> 		__u8     tx_power;
> 		__u8     rssi;
> 		__u8     cte_type;
> 		__u8     data_status;
> 		__u8     length;
> 		__u8     data[];
> 	} __packed;
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly
    https://git.kernel.org/bluetooth/bluetooth-next/c/96995a7d94f3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html