Re: [PATCH net] Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Fri, 15 May 2026 07:25:25 +0100 you wrote:
> ISO data PDUs carry a packet-boundary flag indicating START, CONT, END
> or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing
> ISO_START by checking conn->rx_len before touching conn->rx_skb, but
> ISO_END does not.
> 
> If a peer sends an ISO_END as the first packet on a fresh ISO
> connection, conn->rx_skb is still NULL and conn->rx_len is zero, so
> skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,
> where receivers sync to a broadcaster without pairing, any broadcaster
> on the air can trigger this.
> 
> [...]

Here is the summary with links:
  - [net] Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
    https://git.kernel.org/bluetooth/bluetooth-next/c/6aba94a49bc9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html