[PATCH] Bluetooth: ISO: check end fragment length before appending

[PATCH] Bluetooth: ISO: check end fragment length before appending

[Guangshuo Li]

ISO fragment reassembly keeps conn->rx_len as the remaining space in
conn->rx_skb.

The ISO_CONT path checks both that a reassembly is in progress and that
the incoming fragment does not exceed the remaining length before
appending it to conn->rx_skb. The ISO_END path only checks that a
reassembly is in progress.

A malformed ISO_END fragment can therefore be larger than the remaining
space in conn->rx_skb. In that case skb_put() advances past the end of
the reassembly buffer before the fragment is copied.

Reject oversized ISO_END fragments the same way ISO_CONT does, and drop
the partially reassembled frame.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 net/bluetooth/iso.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 793a481d7066..f5ca8db3c206 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2639,6 +2639,15 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)
 			goto drop;
 		}
 
+		if (skb->len > conn->rx_len) {
+			BT_ERR("End fragment is too long (len %d, expected %d)",
+			       skb->len, conn->rx_len);
+			kfree_skb(conn->rx_skb);
+			conn->rx_skb = NULL;
+			conn->rx_len = 0;
+			goto drop;
+		}
+
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
 					  skb->len);
 		conn->rx_len -= skb->len;
-- 
2.43.0

Re: [PATCH] Bluetooth: ISO: check end fragment length before appending

[Luiz Augusto von Dentz]

Hi Guangshuo,

On Wed, Jul 8, 2026 at 8:12 AM Guangshuo Li <lgs201920130244@gmail.com> wrote:
>
> ISO fragment reassembly keeps conn->rx_len as the remaining space in
> conn->rx_skb.
>
> The ISO_CONT path checks both that a reassembly is in progress and that
> the incoming fragment does not exceed the remaining length before
> appending it to conn->rx_skb. The ISO_END path only checks that a
> reassembly is in progress.
>
> A malformed ISO_END fragment can therefore be larger than the remaining
> space in conn->rx_skb. In that case skb_put() advances past the end of
> the reassembly buffer before the fragment is copied.
>
> Reject oversized ISO_END fragments the same way ISO_CONT does, and drop
> the partially reassembled frame.
>
> Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  net/bluetooth/iso.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 793a481d7066..f5ca8db3c206 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -2639,6 +2639,15 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)
>                         goto drop;
>                 }
>
> +               if (skb->len > conn->rx_len) {
> +                       BT_ERR("End fragment is too long (len %d, expected %d)",
> +                              skb->len, conn->rx_len);
> +                       kfree_skb(conn->rx_skb);
> +                       conn->rx_skb = NULL;
> +                       conn->rx_len = 0;
> +                       goto drop;
> +               }
> +
>                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
>                                           skb->len);
>                 conn->rx_len -= skb->len;
> --
> 2.43.0

Looks like this is already being handled according to sashiko:

https://sashiko.dev/#/patchset/20260708121205.756886-1-lgs201920130244%40gmail.com

-- 
Luiz Augusto von Dentz