Skip to content

[nrf fromtree] Bluetooth: Host: Validate periodic advertising report length - #4496

Merged
rlubos merged 3 commits into
nrfconnect:mainfrom
knutel-nordic:validate-periodic-adv-report-length
Sep 24, 2026
Merged

rlubos merged 3 commits into
nrfconnect:mainfrom
knutel-nordic:validate-periodic-adv-report-length

Conversation

@knutel-nordic

Copy link
Copy Markdown
Contributor

Fromtree Bluetooth: Host: Validate periodic advertising report length

@knutel-nordic
knutel-nordic force-pushed the validate-periodic-adv-report-length branch from 856ca21 to f297b41 Compare September 22, 2026 11:00
NordicBuilder added a commit to NordicBuilder/sdk-nrf that referenced this pull request Sep 22, 2026
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4496

Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
…bricated responses

The fake controller responds to LE Set Extended Scan Parameters, LE Set
Extended Scan Enable and Reset with Command Complete events that carry
no return parameters, although these commands return a status. The host
has been reading the status from beyond the fabricated event parameters,
which happened to yield success. Add the status return parameter, like
the other status-only commands in the table already have, in preparation
for the host validating command responses against the event length.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>

(cherry picked from commit 8f2fea1)
…length

The periodic advertising report handler checks that the event header is
present and that the data fits in the reassembly buffer, but not that
the event actually carries as many data bytes as its length field
claims. With CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0, a report with a
length field larger than the remaining event payload makes
net_buf_simple_add_mem() copy up to 255 bytes from beyond the end of
the HCI event buffer into the reassembly buffer, and the result is
passed on to the application.

Drop such reports the same way as reports that do not fit in the
reassembly buffer.

Fixes #117587

Assisted-by: Claude:claude-fable-5
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>

(cherry picked from commit e9c3252)
@knutel-nordic
knutel-nordic force-pushed the validate-periodic-adv-report-length branch from f297b41 to 6a2266f Compare September 22, 2026 11:40
NordicBuilder added a commit to NordicBuilder/sdk-nrf that referenced this pull request Sep 22, 2026
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4496

Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
…riodic report test

Enable periodic advertising sync in the test configuration and add a
test which establishes a sync with the fake controller and sends
periodic advertising reports whose length field claims more data than
the event carries. The reports must be dropped without invoking the
receive callback, and the sync must remain usable afterwards.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>

(cherry picked from commit 3da48bd)
@knutel-nordic
knutel-nordic force-pushed the validate-periodic-adv-report-length branch from 6a2266f to 0a71742 Compare September 24, 2026 05:24
NordicBuilder added a commit to NordicBuilder/sdk-nrf that referenced this pull request Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4496

Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
@rlubos
rlubos merged commit 6860edc into nrfconnect:main Sep 24, 2026
11 checks passed
NordicBuilder added a commit to NordicBuilder/sdk-nrf that referenced this pull request Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4496

Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
rlubos pushed a commit to nrfconnect/sdk-nrf that referenced this pull request Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4496

Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants