* [PATCH] Bluetooth: ISO: validate ISO_END fragments [not found] <CAKvcANPiqdO_Re3+06DWhb7uyKP+gCODJpo35sq5-x62gYJUPw@mail.gmail.com> @ 2026-03-28 20:09 ` Kangzheng Gu 2026-03-28 20:44 ` bluez.test.bot 0 siblings, 1 reply; 2+ messages in thread From: Kangzheng Gu @ 2026-03-28 20:09 UTC (permalink / raw) To: gregkh, marcel, luiz.dentz, luiz.von.dentz, xiaoguai0992 Cc: linux-bluetooth, linux-kernel, stable A malformed ISO_END fragment can trigger a NULL pointer dereference due to missing validation before processing. An oversized end fragment should also be rejected. Add the same validation for ISO_END as for ISO_CONT, and reset the in-progress reassembly state when malformed input is detected. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Cc: stable@vger.kernel.org Signed-off-by: Kangzheng Gu <xiaoguai0992@gmail.com> --- net/bluetooth/iso.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index be145e2736b7..8707f3c4b103 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -2587,6 +2587,27 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags) break; case ISO_END: + BT_DBG("End: frag len %d (expecting %d)", skb->len, + conn->rx_len); + + if (!conn->rx_len) { + BT_ERR("Unexpected end frame (len %d)", + skb->len); + kfree_skb(conn->rx_skb); + conn->rx_skb = NULL; + conn->rx_len = 0; + goto drop; + } + + if (skb->len > conn->rx_len) { + BT_ERR("Fragment is too long (len %d, expected %d)", + skb->len, conn->rx_len); + kfree_skb(conn->rx_skb); + conn->rx_skb = NULL; + conn->rx_len = 0; + goto drop; + } + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), skb->len); conn->rx_len -= skb->len; -- 2.50.1 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: Bluetooth: ISO: validate ISO_END fragments 2026-03-28 20:09 ` [PATCH] Bluetooth: ISO: validate ISO_END fragments Kangzheng Gu @ 2026-03-28 20:44 ` bluez.test.bot 0 siblings, 0 replies; 2+ messages in thread From: bluez.test.bot @ 2026-03-28 20:44 UTC (permalink / raw) To: linux-bluetooth, xiaoguai0992 [-- Attachment #1: Type: text/plain, Size: 2913 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1074052 ---Test result--- Test Summary: CheckPatch PENDING 0.25 seconds GitLint PENDING 0.20 seconds SubjectPrefix PASS 0.12 seconds BuildKernel PASS 26.03 seconds CheckAllWarning PASS 28.36 seconds CheckSparse PASS 27.30 seconds BuildKernel32 PASS 26.91 seconds TestRunnerSetup PASS 567.23 seconds TestRunner_l2cap-tester PASS 27.98 seconds TestRunner_iso-tester PASS 35.49 seconds TestRunner_bnep-tester PASS 6.46 seconds TestRunner_mgmt-tester FAIL 114.56 seconds TestRunner_rfcomm-tester PASS 9.50 seconds TestRunner_sco-tester FAIL 14.27 seconds TestRunner_ioctl-tester PASS 10.11 seconds TestRunner_mesh-tester FAIL 11.42 seconds TestRunner_smp-tester PASS 8.63 seconds TestRunner_userchan-tester PASS 6.69 seconds IncrementalBuild PENDING 0.53 seconds Details ############################## Test: CheckPatch - PENDING Desc: Run checkpatch.pl script Output: ############################## Test: GitLint - PENDING Desc: Run gitlint Output: ############################## Test: TestRunner_mgmt-tester - FAIL Desc: Run mgmt-tester with test-runner Output: Total: 494, Passed: 485 (98.2%), Failed: 5, Not Run: 4 Failed Test Cases Adv. connectable & connected (central) - Success Failed 0.131 seconds Adv. non-connectable & connected (central) - Success Failed 0.129 seconds Ext Adv. connectable & connected (central) Failed 0.180 seconds Ext Adv. non-connectable & connected (central) Failed 0.184 seconds Read Exp Feature - Success Failed 0.115 seconds ############################## Test: TestRunner_sco-tester - FAIL Desc: Run sco-tester with test-runner Output: WARNING: possible circular locking dependency detected BUG: sleeping function called from invalid context at net/core/sock.c:3782 Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner_mesh-tester - FAIL Desc: Run mesh-tester with test-runner Output: Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0 Failed Test Cases Mesh - Send cancel - 1 Timed out 1.875 seconds Mesh - Send cancel - 2 Timed out 2.001 seconds ############################## Test: IncrementalBuild - PENDING Desc: Incremental build with the patches in the series Output: --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-03-28 20:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CAKvcANPiqdO_Re3+06DWhb7uyKP+gCODJpo35sq5-x62gYJUPw@mail.gmail.com>
2026-03-28 20:09 ` [PATCH] Bluetooth: ISO: validate ISO_END fragments Kangzheng Gu
2026-03-28 20:44 ` bluez.test.bot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox