Re: [PATCH] Bluetooth: hci_codec: validate vendor codec count length

Hi Laxman,

On Sun, Aug 23, 2026 at 12:16 PM Laxman Acharya Padhya
<[email protected]> wrote:
>
> The Read Local Supported Codecs parsers consume the variable-sized
> standard codec array before parsing the vendor codec count.  Although the
> initial reply-size check includes a vendor count byte in the fixed layout,
> it does not guarantee that the byte remains after the standard codec array.
>
> If a controller reply ends immediately after that array, calculating the
> vendor codec array size reads vnd_codecs->num beyond the skb data.  Require
> the vendor codec header to be present before using its count in both
> command variants.
>
> Fixes: 8961987f3f5f ("Bluetooth: Enumerate local supported codec and cache details")
> Fixes: 9ae664028a9e ("Bluetooth: Add support for Read Local Supported Codecs V2")
> Cc: [email protected]
> Signed-off-by: Laxman Acharya Padhya <[email protected]>
> ---
>  net/bluetooth/hci_codec.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/bluetooth/hci_codec.c b/net/bluetooth/hci_codec.c
> index 5bc5003c387c..99394a3348c7 100644
> --- a/net/bluetooth/hci_codec.c
> +++ b/net/bluetooth/hci_codec.c
> @@ -165,6 +165,8 @@ void hci_read_supported_codecs(struct hci_dev *hdev)
>                  + sizeof(std_codecs->num));
>
>         vnd_codecs = (void *)skb->data;
> +       if (skb->len < sizeof(*vnd_codecs))
> +               goto error;

If Im not mistake the following code already validates skb->len:

/* validate vendor codecs length before accessing */
if (skb->len <
   flex_array_size(vnd_codecs, codec, vnd_codecs->num)
   + sizeof(vnd_codecs->num))
goto error;

sizeof(vnd_codecs->num) is equivalent to what you are proposing with
sizeof(*vnd_codecs), so this doesn't fix anything it just duplicates
the testing for the minimal size.

>         /* validate vendor codecs length before accessing */
>         if (skb->len <
> @@ -233,6 +235,8 @@ void hci_read_supported_codecs_v2(struct hci_dev *hdev)
>                  + sizeof(std_codecs->num));
>
>         vnd_codecs = (void *)skb->data;
> +       if (skb->len < sizeof(*vnd_codecs))
> +               goto error;
>
>         /* check for payload data length before accessing */
>         if (skb->len <
> --
> 2.50.1



-- 
Luiz Augusto von Dentz