Re: [PATCH v3] Bluetooth: eir: Fix OOB read in eir_get_service_data()

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Sat, 15 Aug 2026 15:24:19 +0900 you wrote:
> eir_get_service_data() walks the advertising data for a Service Data
> field with a matching UUID.  On a mismatch it advances:
> 
>     eir += dlen;
>     eir_len -= dlen;
> 
> eir_get_data() reports dlen as the field's data length, but the field
> spans dlen + 2 bytes once its length and type bytes count, and more
> when non-Service-Data fields were skipped to reach it.  The pointer
> lands correctly on the next field.  eir_len does not, and the shortfall
> compounds across fields until eir_get_data() reads the length and type
> bytes of a "field" past the end of the buffer.
> 
> [...]

Here is the summary with links:
  - [v3] Bluetooth: eir: Fix OOB read in eir_get_service_data()
    https://git.kernel.org/bluetooth/bluetooth-next/c/14a97a38ba8f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html