Commit 84c24fb1 authored by David Carlier's avatar David Carlier Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: ISO: drop ISO_END frames received without prior ISO_START 



ISO data PDUs carry a packet-boundary flag indicating START, CONT, END
or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing
ISO_START by checking conn->rx_len before touching conn->rx_skb, but
ISO_END does not.

If a peer sends an ISO_END as the first packet on a fresh ISO
connection, conn->rx_skb is still NULL and conn->rx_len is zero, so
skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,
where receivers sync to a broadcaster without pairing, any broadcaster
on the air can trigger this.

Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment
is logged and dropped instead of crashing the host.

Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: default avatarDavid Carlier <devnexen@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 88365d04

net/bluetooth/iso.c

+5 −0
Original line number Diff line number Diff line
@@ -2593,6 +2593,11 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags) 
		break;



	case ISO_END:

		if (!conn->rx_len) {

			BT_ERR("Unexpected end frame (len %d)", skb->len);

			goto drop;

		}



		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),

					  skb->len);

		conn->rx_len -= skb->len;