Bluetooth Host ISO RX Missing SDU Header Length Validation in bt_iso_recv() Leads to DoS

An attacker who can influence incoming HCI ISO data — for example by controlling a malicious Bluetooth controller or by injecting malformed forwarded ISO traffic — sends a packet whose HCI ISO payload length is valid at the outer layer (e.g. length=1) but too small to contain the required SDU header. The outer check in hci_iso() passes because it only validates payload length consistency, not the minimum inner header size. When bt_iso_recv() processes the fragment as PB=START/SINGLE, it calls net_buf_pull_mem() to pull either an 8-byte TS header or a 4-byte non-TS header without first verifying that buf->len is at least that many bytes [ref_id=1]. This triggers a kernel assert in assert-enabled builds, causing a deterministic denial of service; in non-assert builds the undersized buffer may lead to out-of-bounds read behavior [ref_id=1].

The patch adds a per-branch length check before each net_buf_pull_mem() call in bt_iso_recv(), ensuring that buf->len is at least sizeof(struct bt_hci_iso_sdu_ts_hdr) (8 bytes) when ts=1, or sizeof(struct bt_hci_iso_sdu_hdr) (4 bytes) when ts=0 [ref_id=1]. If the buffer is too short, the function returns an error instead of proceeding to pull. This closes the gap between the outer HCI ISO length validation in hci_iso() and the inner SDU header parsing, preventing the assert and the potential out-of-bounds read.