AZL-96473

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidprecvctrlframe() and hidprecvintrframe() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidpsessionrun(), with the uninitialized value originating in __allocskb() through vhciwrite(). The control path produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2caprecvacldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDPTRANSHIDCONTROL | HIDPCTRLVIRTUALCABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds.

Pull the transaction header with skbpulldata() and discard frames that do not contain it.