* [PATCH] Bluetooth: HIDP: add missing length check for incoming frames
@ 2026-07-17 15:32 Jiale Yao
2026-07-17 15:40 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 8+ messages in thread
From: Jiale Yao @ 2026-07-17 15:32 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, Jiale Yao, Tim Bird,
Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth,
linux-kernel
In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
read without verifying that skb->len >= 1. A zero-length L2CAP PDU
delivered via the HIDP control or interrupt channel causes an
out-of-bounds read.
Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
parsing") which addressed the same class of bug in BNEP.
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
net/bluetooth/hidp/core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0e24c5e2955e..6c7da8aca732 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+ if (!pskb_may_pull(skb, 1))
+ return;
hdr = skb->data[0];
skb_pull(skb, 1);
@@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+ if (!pskb_may_pull(skb, 1))
+ return;
hdr = skb->data[0];
skb_pull(skb, 1);
--
2.34.1
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-17 15:32 [PATCH] Bluetooth: HIDP: add missing length check for incoming frames Jiale Yao
@ 2026-07-17 15:40 ` Luiz Augusto von Dentz
2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao
0 siblings, 1 reply; 8+ messages in thread
From: Luiz Augusto von Dentz @ 2026-07-17 15:40 UTC (permalink / raw)
To: Jiale Yao
Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook,
Michael Bommarito, linux-bluetooth, linux-kernel
Hi,
On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote:
>
> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> delivered via the HIDP control or interrupt channel causes an
> out-of-bounds read.
>
> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
> parsing") which addressed the same class of bug in BNEP.
>
> Assisted-by: Claude:deepseek-v4-pro
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
> net/bluetooth/hidp/core.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> index 0e24c5e2955e..6c7da8aca732 100644
> --- a/net/bluetooth/hidp/core.c
> +++ b/net/bluetooth/hidp/core.c
> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> + if (!pskb_may_pull(skb, 1))
> + return;
We can probably replace this with skb_pull_data.
> hdr = skb->data[0];
> skb_pull(skb, 1);
>
> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> + if (!pskb_may_pull(skb, 1))
> + return;
Ditto.
> hdr = skb->data[0];
> skb_pull(skb, 1);
>
> --
> 2.34.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-17 15:40 ` Luiz Augusto von Dentz
@ 2026-07-19 5:37 ` jiale yao
2026-07-20 19:47 ` Luiz Augusto von Dentz
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: jiale yao @ 2026-07-19 5:37 UTC (permalink / raw)
To: Luiz Augusto von Dentz
Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook,
Michael Bommarito, linux-bluetooth, linux-kernel
In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
read without verifying that skb->len >= 1. A zero-length L2CAP PDU
delivered via the HIDP control or interrupt channel causes an
out-of-bounds read.
Use skb_pull_data(skb, 1) which combines the length check and pull
in one operation, matching the existing pattern in hidp_input_report()
and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
frames before parsing") which addressed the same class of bug in BNEP.
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
net/bluetooth/hidp/core.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0e24c5e2955e..bb61602b02e1 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
static void hidp_recv_ctrl_frame(struct hidp_session *session,
struct sk_buff *skb)
{
- unsigned char hdr, type, param;
+ unsigned char *hdr;
+ unsigned char type, param;
int free_skb = 1;
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
- hdr = skb->data[0];
- skb_pull(skb, 1);
+ hdr = skb_pull_data(skb, 1);
+ if (!hdr)
+ return;
- type = hdr & HIDP_HEADER_TRANS_MASK;
- param = hdr & HIDP_HEADER_PARAM_MASK;
+ type = *hdr & HIDP_HEADER_TRANS_MASK;
+ param = *hdr & HIDP_HEADER_PARAM_MASK;
switch (type) {
case HIDP_TRANS_HANDSHAKE:
@@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
static void hidp_recv_intr_frame(struct hidp_session *session,
struct sk_buff *skb)
{
- unsigned char hdr;
+ unsigned char *hdr;
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
- hdr = skb->data[0];
- skb_pull(skb, 1);
+ hdr = skb_pull_data(skb, 1);
+ if (!hdr)
+ return;
- if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
+ if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
hidp_set_timer(session);
if (session->input)
--
2.34.1
At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
>Hi,
>
>On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote:
>>
>> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
>> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
>> delivered via the HIDP control or interrupt channel causes an
>> out-of-bounds read.
>>
>> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
>> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
>> parsing") which addressed the same class of bug in BNEP.
>>
>> Assisted-by: Claude:deepseek-v4-pro
>> Signed-off-by: Jiale Yao <yaojiale02@163.com>
>> ---
>> net/bluetooth/hidp/core.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
>> index 0e24c5e2955e..6c7da8aca732 100644
>> --- a/net/bluetooth/hidp/core.c
>> +++ b/net/bluetooth/hidp/core.c
>> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
>>
>> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>>
>> + if (!pskb_may_pull(skb, 1))
>> + return;
>
>We can probably replace this with skb_pull_data.
>
>> hdr = skb->data[0];
>> skb_pull(skb, 1);
>>
>> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
>>
>> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>>
>> + if (!pskb_may_pull(skb, 1))
>> + return;
>
>Ditto.
>
>> hdr = skb->data[0];
>> skb_pull(skb, 1);
>>
>> --
>> 2.34.1
>>
>
>
>--
>Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao
@ 2026-07-20 19:47 ` Luiz Augusto von Dentz
2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao
2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot
2026-08-16 2:19 ` kernel test robot
2 siblings, 1 reply; 8+ messages in thread
From: Luiz Augusto von Dentz @ 2026-07-20 19:47 UTC (permalink / raw)
To: jiale yao
Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook,
Michael Bommarito, linux-bluetooth, linux-kernel
Hi,
On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote:
>
>
>
>
>
>
>
> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> delivered via the HIDP control or interrupt channel causes an
> out-of-bounds read.
>
> Use skb_pull_data(skb, 1) which combines the length check and pull
> in one operation, matching the existing pattern in hidp_input_report()
> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
> frames before parsing") which addressed the same class of bug in BNEP.
>
> Assisted-by: Claude:deepseek-v4-pro
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
> net/bluetooth/hidp/core.c | 21 ++++++++++++---------
> 1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> index 0e24c5e2955e..bb61602b02e1 100644
> --- a/net/bluetooth/hidp/core.c
> +++ b/net/bluetooth/hidp/core.c
> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
> static void hidp_recv_ctrl_frame(struct hidp_session *session,
> struct sk_buff *skb)
> {
> - unsigned char hdr, type, param;
> + unsigned char *hdr;
> + unsigned char type, param;
> int free_skb = 1;
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> - hdr = skb->data[0];
> - skb_pull(skb, 1);
> + hdr = skb_pull_data(skb, 1);
> + if (!hdr)
> + return;
https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com
It seems that by early returning we are leaking the skb.
>
> - type = hdr & HIDP_HEADER_TRANS_MASK;
> - param = hdr & HIDP_HEADER_PARAM_MASK;
> + type = *hdr & HIDP_HEADER_TRANS_MASK;
> + param = *hdr & HIDP_HEADER_PARAM_MASK;
>
> switch (type) {
> case HIDP_TRANS_HANDSHAKE:
> @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> static void hidp_recv_intr_frame(struct hidp_session *session,
> struct sk_buff *skb)
> {
> - unsigned char hdr;
> + unsigned char *hdr;
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> - hdr = skb->data[0];
> - skb_pull(skb, 1);
> + hdr = skb_pull_data(skb, 1);
> + if (!hdr)
> + return;
>
> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> hidp_set_timer(session);
>
> if (session->input)
> --
> 2.34.1
>
>
>
>
>
>
>
>
>
>
>
>
> At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
> >Hi,
> >
> >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote:
> >>
> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> >> delivered via the HIDP control or interrupt channel causes an
> >> out-of-bounds read.
> >>
> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
> >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
> >> parsing") which addressed the same class of bug in BNEP.
> >>
> >> Assisted-by: Claude:deepseek-v4-pro
> >> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> >> ---
> >> net/bluetooth/hidp/core.c | 4 ++++
> >> 1 file changed, 4 insertions(+)
> >>
> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> >> index 0e24c5e2955e..6c7da8aca732 100644
> >> --- a/net/bluetooth/hidp/core.c
> >> +++ b/net/bluetooth/hidp/core.c
> >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> >>
> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >>
> >> + if (!pskb_may_pull(skb, 1))
> >> + return;
> >
> >We can probably replace this with skb_pull_data.
> >
> >> hdr = skb->data[0];
> >> skb_pull(skb, 1);
> >>
> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
> >>
> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >>
> >> + if (!pskb_may_pull(skb, 1))
> >> + return;
> >
> >Ditto.
> >
> >> hdr = skb->data[0];
> >> skb_pull(skb, 1);
> >>
> >> --
> >> 2.34.1
> >>
> >
> >
> >--
> >Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re:Re: Re: [PATCH v3] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-20 19:47 ` Luiz Augusto von Dentz
@ 2026-07-21 5:54 ` jiale yao
2026-07-22 0:06 ` Muhammad Bilal
0 siblings, 1 reply; 8+ messages in thread
From: jiale yao @ 2026-07-21 5:54 UTC (permalink / raw)
To: Luiz Augusto von Dentz
Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook,
Michael Bommarito, linux-bluetooth, linux-kernel
In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
read without verifying that skb->len >= 1. A zero-length L2CAP PDU
delivered via the HIDP control or interrupt channel causes an
out-of-bounds read.
Use skb_pull_data(skb, 1) which combines the length check and pull
in one operation, matching the existing pattern in hidp_input_report()
and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
frames before parsing") which addressed the same class of bug in BNEP.
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
net/bluetooth/hidp/core.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0e24c5e2955e..e29fe66f01d4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
static void hidp_recv_ctrl_frame(struct hidp_session *session,
struct sk_buff *skb)
{
- unsigned char hdr, type, param;
+ unsigned char *hdr;
+ unsigned char type, param;
int free_skb = 1;
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
- hdr = skb->data[0];
- skb_pull(skb, 1);
+ hdr = skb_pull_data(skb, 1);
+ if (!hdr)
+ goto failed;
- type = hdr & HIDP_HEADER_TRANS_MASK;
- param = hdr & HIDP_HEADER_PARAM_MASK;
+ type = *hdr & HIDP_HEADER_TRANS_MASK;
+ param = *hdr & HIDP_HEADER_PARAM_MASK;
switch (type) {
case HIDP_TRANS_HANDSHAKE:
@@ -590,6 +592,7 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
break;
}
+failed:
if (free_skb)
kfree_skb(skb);
}
@@ -597,14 +600,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
static void hidp_recv_intr_frame(struct hidp_session *session,
struct sk_buff *skb)
{
- unsigned char hdr;
+ unsigned char *hdr;
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
- hdr = skb->data[0];
- skb_pull(skb, 1);
+ hdr = skb_pull_data(skb, 1);
+ if (!hdr)
+ goto failed;
- if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
+ if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
hidp_set_timer(session);
if (session->input)
@@ -616,9 +620,10 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
BT_DBG("report len %d", skb->len);
}
} else {
- BT_DBG("Unsupported protocol header 0x%02x", hdr);
+ BT_DBG("Unsupported protocol header 0x%02x", *hdr);
}
+failed:
kfree_skb(skb);
}
--
2.34.1
At 2026-07-21 03:47:21, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
>Hi,
>
>On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote:
>>
>>
>>
>>
>>
>>
>>
>> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
>> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
>> delivered via the HIDP control or interrupt channel causes an
>> out-of-bounds read.
>>
>> Use skb_pull_data(skb, 1) which combines the length check and pull
>> in one operation, matching the existing pattern in hidp_input_report()
>> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
>> frames before parsing") which addressed the same class of bug in BNEP.
>>
>> Assisted-by: Claude:deepseek-v4-pro
>> Signed-off-by: Jiale Yao <yaojiale02@163.com>
>> ---
>> net/bluetooth/hidp/core.c | 21 ++++++++++++---------
>> 1 file changed, 12 insertions(+), 9 deletions(-)
>>
>> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
>> index 0e24c5e2955e..bb61602b02e1 100644
>> --- a/net/bluetooth/hidp/core.c
>> +++ b/net/bluetooth/hidp/core.c
>> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
>> static void hidp_recv_ctrl_frame(struct hidp_session *session,
>> struct sk_buff *skb)
>> {
>> - unsigned char hdr, type, param;
>> + unsigned char *hdr;
>> + unsigned char type, param;
>> int free_skb = 1;
>>
>> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>>
>> - hdr = skb->data[0];
>> - skb_pull(skb, 1);
>> + hdr = skb_pull_data(skb, 1);
>> + if (!hdr)
>> + return;
>
>https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com
>
>It seems that by early returning we are leaking the skb.
>
>>
>> - type = hdr & HIDP_HEADER_TRANS_MASK;
>> - param = hdr & HIDP_HEADER_PARAM_MASK;
>> + type = *hdr & HIDP_HEADER_TRANS_MASK;
>> + param = *hdr & HIDP_HEADER_PARAM_MASK;
>>
>> switch (type) {
>> case HIDP_TRANS_HANDSHAKE:
>> @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
>> static void hidp_recv_intr_frame(struct hidp_session *session,
>> struct sk_buff *skb)
>> {
>> - unsigned char hdr;
>> + unsigned char *hdr;
>>
>> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>>
>> - hdr = skb->data[0];
>> - skb_pull(skb, 1);
>> + hdr = skb_pull_data(skb, 1);
>> + if (!hdr)
>> + return;
>>
>> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
>> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
>> hidp_set_timer(session);
>>
>> if (session->input)
>> --
>> 2.34.1
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
>> >Hi,
>> >
>> >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote:
>> >>
>> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
>> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
>> >> delivered via the HIDP control or interrupt channel causes an
>> >> out-of-bounds read.
>> >>
>> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
>> >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
>> >> parsing") which addressed the same class of bug in BNEP.
>> >>
>> >> Assisted-by: Claude:deepseek-v4-pro
>> >> Signed-off-by: Jiale Yao <yaojiale02@163.com>
>> >> ---
>> >> net/bluetooth/hidp/core.c | 4 ++++
>> >> 1 file changed, 4 insertions(+)
>> >>
>> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
>> >> index 0e24c5e2955e..6c7da8aca732 100644
>> >> --- a/net/bluetooth/hidp/core.c
>> >> +++ b/net/bluetooth/hidp/core.c
>> >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
>> >>
>> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>> >>
>> >> + if (!pskb_may_pull(skb, 1))
>> >> + return;
>> >
>> >We can probably replace this with skb_pull_data.
>> >
>> >> hdr = skb->data[0];
>> >> skb_pull(skb, 1);
>> >>
>> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
>> >>
>> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>> >>
>> >> + if (!pskb_may_pull(skb, 1))
>> >> + return;
>> >
>> >Ditto.
>> >
>> >> hdr = skb->data[0];
>> >> skb_pull(skb, 1);
>> >>
>> >> --
>> >> 2.34.1
>> >>
>> >
>> >
>> >--
>> >Luiz Augusto von Dentz
>
>
>
>--
>Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re: Re: [PATCH v3] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao
@ 2026-07-22 0:06 ` Muhammad Bilal
0 siblings, 0 replies; 8+ messages in thread
From: Muhammad Bilal @ 2026-07-22 0:06 UTC (permalink / raw)
To: jiale yao
Cc: Luiz Augusto von Dentz, Marcel Holtmann, Tim Bird, Kees Cook,
Michael Bommarito, linux-bluetooth, linux-kernel
Hi Jiale,
Looks correct. Both goto failed paths free the skb properly now, and
the intr_frame goto also avoids a NULL hdr deref.
Reviewed-by: Muhammad Bilal <meatuni001@gmail.com>
Thanks,
Muhammad Bilal
On Tue, Jul 21, 2026 at 10:55 AM jiale yao <19888972804@163.com> wrote:
>
> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> delivered via the HIDP control or interrupt channel causes an
> out-of-bounds read.
>
> Use skb_pull_data(skb, 1) which combines the length check and pull
> in one operation, matching the existing pattern in hidp_input_report()
> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
> frames before parsing") which addressed the same class of bug in BNEP.
>
> Assisted-by: Claude:deepseek-v4-pro
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
> net/bluetooth/hidp/core.c | 25 +++++++++++++++----------
> 1 file changed, 15 insertions(+), 10 deletions(-)
>
> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> index 0e24c5e2955e..e29fe66f01d4 100644
> --- a/net/bluetooth/hidp/core.c
> +++ b/net/bluetooth/hidp/core.c
> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
> static void hidp_recv_ctrl_frame(struct hidp_session *session,
> struct sk_buff *skb)
> {
> - unsigned char hdr, type, param;
> + unsigned char *hdr;
> + unsigned char type, param;
> int free_skb = 1;
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> - hdr = skb->data[0];
> - skb_pull(skb, 1);
> + hdr = skb_pull_data(skb, 1);
> + if (!hdr)
> + goto failed;
>
> - type = hdr & HIDP_HEADER_TRANS_MASK;
> - param = hdr & HIDP_HEADER_PARAM_MASK;
> + type = *hdr & HIDP_HEADER_TRANS_MASK;
> + param = *hdr & HIDP_HEADER_PARAM_MASK;
>
> switch (type) {
> case HIDP_TRANS_HANDSHAKE:
> @@ -590,6 +592,7 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> break;
> }
>
> +failed:
> if (free_skb)
> kfree_skb(skb);
> }
> @@ -597,14 +600,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> static void hidp_recv_intr_frame(struct hidp_session *session,
> struct sk_buff *skb)
> {
> - unsigned char hdr;
> + unsigned char *hdr;
>
> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> - hdr = skb->data[0];
> - skb_pull(skb, 1);
> + hdr = skb_pull_data(skb, 1);
> + if (!hdr)
> + goto failed;
>
> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> hidp_set_timer(session);
>
> if (session->input)
> @@ -616,9 +620,10 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
> BT_DBG("report len %d", skb->len);
> }
> } else {
> - BT_DBG("Unsupported protocol header 0x%02x", hdr);
> + BT_DBG("Unsupported protocol header 0x%02x", *hdr);
> }
>
> +failed:
> kfree_skb(skb);
> }
>
> --
> 2.34.1
>
>
>
>
>
>
>
> At 2026-07-21 03:47:21, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
> >Hi,
> >
> >On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote:
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> >> delivered via the HIDP control or interrupt channel causes an
> >> out-of-bounds read.
> >>
> >> Use skb_pull_data(skb, 1) which combines the length check and pull
> >> in one operation, matching the existing pattern in hidp_input_report()
> >> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short
> >> frames before parsing") which addressed the same class of bug in BNEP.
> >>
> >> Assisted-by: Claude:deepseek-v4-pro
> >> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> >> ---
> >> net/bluetooth/hidp/core.c | 21 ++++++++++++---------
> >> 1 file changed, 12 insertions(+), 9 deletions(-)
> >>
> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> >> index 0e24c5e2955e..bb61602b02e1 100644
> >> --- a/net/bluetooth/hidp/core.c
> >> +++ b/net/bluetooth/hidp/core.c
> >> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
> >> static void hidp_recv_ctrl_frame(struct hidp_session *session,
> >> struct sk_buff *skb)
> >> {
> >> - unsigned char hdr, type, param;
> >> + unsigned char *hdr;
> >> + unsigned char type, param;
> >> int free_skb = 1;
> >>
> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >>
> >> - hdr = skb->data[0];
> >> - skb_pull(skb, 1);
> >> + hdr = skb_pull_data(skb, 1);
> >> + if (!hdr)
> >> + return;
> >
> >https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com
> >
> >It seems that by early returning we are leaking the skb.
> >
> >>
> >> - type = hdr & HIDP_HEADER_TRANS_MASK;
> >> - param = hdr & HIDP_HEADER_PARAM_MASK;
> >> + type = *hdr & HIDP_HEADER_TRANS_MASK;
> >> + param = *hdr & HIDP_HEADER_PARAM_MASK;
> >>
> >> switch (type) {
> >> case HIDP_TRANS_HANDSHAKE:
> >> @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> >> static void hidp_recv_intr_frame(struct hidp_session *session,
> >> struct sk_buff *skb)
> >> {
> >> - unsigned char hdr;
> >> + unsigned char *hdr;
> >>
> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >>
> >> - hdr = skb->data[0];
> >> - skb_pull(skb, 1);
> >> + hdr = skb_pull_data(skb, 1);
> >> + if (!hdr)
> >> + return;
> >>
> >> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> >> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
> >> hidp_set_timer(session);
> >>
> >> if (session->input)
> >> --
> >> 2.34.1
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote:
> >> >Hi,
> >> >
> >> >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote:
> >> >>
> >> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> >> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU
> >> >> delivered via the HIDP control or interrupt channel causes an
> >> >> out-of-bounds read.
> >> >>
> >> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
> >> >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
> >> >> parsing") which addressed the same class of bug in BNEP.
> >> >>
> >> >> Assisted-by: Claude:deepseek-v4-pro
> >> >> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> >> >> ---
> >> >> net/bluetooth/hidp/core.c | 4 ++++
> >> >> 1 file changed, 4 insertions(+)
> >> >>
> >> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> >> >> index 0e24c5e2955e..6c7da8aca732 100644
> >> >> --- a/net/bluetooth/hidp/core.c
> >> >> +++ b/net/bluetooth/hidp/core.c
> >> >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
> >> >>
> >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >> >>
> >> >> + if (!pskb_may_pull(skb, 1))
> >> >> + return;
> >> >
> >> >We can probably replace this with skb_pull_data.
> >> >
> >> >> hdr = skb->data[0];
> >> >> skb_pull(skb, 1);
> >> >>
> >> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
> >> >>
> >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len);
> >> >>
> >> >> + if (!pskb_may_pull(skb, 1))
> >> >> + return;
> >> >
> >> >Ditto.
> >> >
> >> >> hdr = skb->data[0];
> >> >> skb_pull(skb, 1);
> >> >>
> >> >> --
> >> >> 2.34.1
> >> >>
> >> >
> >> >
> >> >--
> >> >Luiz Augusto von Dentz
> >
> >
> >
> >--
> >Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao
2026-07-20 19:47 ` Luiz Augusto von Dentz
@ 2026-08-14 4:27 ` kernel test robot
2026-08-16 2:19 ` kernel test robot
2 siblings, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-08-14 4:27 UTC (permalink / raw)
To: jiale yao, Luiz Augusto von Dentz
Cc: oe-kbuild-all, Marcel Holtmann, Tim Bird, Muhammad Bilal,
Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel
Hi jiale,
kernel test robot noticed the following build warnings:
[auto build test WARNING on kees/for-next/pstore]
[also build test WARNING on kees/for-next/kspp]
[cannot apply to bluetooth-next/master bluetooth/master linus/master v7.2-rc7 next-20260812]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/jiale-yao/Re-Re-PATCH-v2-Bluetooth-HIDP-add-missing-length-check-for-incoming-frames/20260814-100503
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore
patch link: https://lore.kernel.org/r/220b6be5.d3f.19f78e165aa.Coremail.19888972804%40163.com
patch subject: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260814/202608141113.WMJnrfnI-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260814/202608141113.WMJnrfnI-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608141113.WMJnrfnI-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from include/asm-generic/bug.h:31,
from arch/powerpc/include/asm/bug.h:116,
from include/linux/bug.h:5,
from include/linux/thread_info.h:13,
from include/asm-generic/preempt.h:5,
from arch/powerpc/include/asm/preempt.h:5,
from include/linux/preempt.h:79,
from include/linux/spinlock.h:56,
from include/linux/kref.h:16,
from net/bluetooth/hidp/core.c:24:
net/bluetooth/hidp/core.c: In function 'hidp_recv_intr_frame':
>> net/bluetooth/hidp/core.c:612:24: warning: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'unsigned char *' [-Wformat=]
612 | BT_DBG("Unsupported protocol header 0x%02x", hdr);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/printk.h:401:21: note: in definition of macro 'pr_fmt'
401 | #define pr_fmt(fmt) fmt
| ^~~
include/linux/dynamic_debug.h:259:9: note: in expansion of macro '__dynamic_func_call_cls'
259 | __dynamic_func_call_cls(__UNIQUE_ID(ddebug), cls, fmt, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~~
include/linux/dynamic_debug.h:261:9: note: in expansion of macro '_dynamic_func_call_cls'
261 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/dynamic_debug.h:280:9: note: in expansion of macro '_dynamic_func_call'
280 | _dynamic_func_call(fmt, __dynamic_pr_debug, \
| ^~~~~~~~~~~~~~~~~~
include/linux/printk.h:635:9: note: in expansion of macro 'dynamic_pr_debug'
635 | dynamic_pr_debug(fmt, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~
include/net/bluetooth/bluetooth.h:287:33: note: in expansion of macro 'pr_debug'
287 | #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__)
| ^~~~~~~~
net/bluetooth/hidp/core.c:612:17: note: in expansion of macro 'BT_DBG'
612 | BT_DBG("Unsupported protocol header 0x%02x", hdr);
| ^~~~~~
net/bluetooth/hidp/core.c:612:58: note: format string is defined here
612 | BT_DBG("Unsupported protocol header 0x%02x", hdr);
| ~~~^
| |
| unsigned int
| %02hhn
vim +612 net/bluetooth/hidp/core.c
^1da177e4c3f415 Linus Torvalds 2005-04-16 588
91f5cca3d1b4341 Andrew Morton 2008-02-05 589 static void hidp_recv_intr_frame(struct hidp_session *session,
91f5cca3d1b4341 Andrew Morton 2008-02-05 590 struct sk_buff *skb)
^1da177e4c3f415 Linus Torvalds 2005-04-16 591 {
afd2c613d3369fb jiale yao 2026-07-19 592 unsigned char *hdr;
^1da177e4c3f415 Linus Torvalds 2005-04-16 593
093dabb4f1aff98 Kai Ye 2021-06-03 594 BT_DBG("session %p skb %p len %u", session, skb, skb->len);
^1da177e4c3f415 Linus Torvalds 2005-04-16 595
afd2c613d3369fb jiale yao 2026-07-19 596 hdr = skb_pull_data(skb, 1);
afd2c613d3369fb jiale yao 2026-07-19 597 if (!hdr)
afd2c613d3369fb jiale yao 2026-07-19 598 return;
^1da177e4c3f415 Linus Torvalds 2005-04-16 599
afd2c613d3369fb jiale yao 2026-07-19 600 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 601 hidp_set_timer(session);
e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 602
^1da177e4c3f415 Linus Torvalds 2005-04-16 603 if (session->input)
^1da177e4c3f415 Linus Torvalds 2005-04-16 604 hidp_input_report(session, skb);
e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 605
e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 606 if (session->hid) {
a4b1b5877b514b2 David Rheinsberg 2013-12-19 607 hidp_process_report(session, HID_INPUT_REPORT,
a4b1b5877b514b2 David Rheinsberg 2013-12-19 608 skb->data, skb->len, 1);
e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 609 BT_DBG("report len %d", skb->len);
e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 610 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 611 } else {
^1da177e4c3f415 Linus Torvalds 2005-04-16 @612 BT_DBG("Unsupported protocol header 0x%02x", hdr);
^1da177e4c3f415 Linus Torvalds 2005-04-16 613 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 614
^1da177e4c3f415 Linus Torvalds 2005-04-16 615 kfree_skb(skb);
^1da177e4c3f415 Linus Torvalds 2005-04-16 616 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 617
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao
2026-07-20 19:47 ` Luiz Augusto von Dentz
2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot
@ 2026-08-16 2:19 ` kernel test robot
2 siblings, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-08-16 2:19 UTC (permalink / raw)
To: jiale yao, Luiz Augusto von Dentz
Cc: llvm, oe-kbuild-all, Marcel Holtmann, Tim Bird, Muhammad Bilal,
Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel
Hi jiale,
kernel test robot noticed the following build warnings:
[auto build test WARNING on kees/for-next/pstore]
[also build test WARNING on kees/for-next/kspp]
[cannot apply to bluetooth-next/master bluetooth/master linus/master v7.2-rc7 next-20260814]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/jiale-yao/Re-Re-PATCH-v2-Bluetooth-HIDP-add-missing-length-check-for-incoming-frames/20260814-100503
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore
patch link: https://lore.kernel.org/r/220b6be5.d3f.19f78e165aa.Coremail.19888972804%40163.com
patch subject: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260816/202608161044.9x6CmhDO-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 844a18e753e822736c9805ab779144b647a2c186)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260816/202608161044.9x6CmhDO-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608161044.9x6CmhDO-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> net/bluetooth/hidp/core.c:612:48: warning: format specifies type 'unsigned int' but the argument has type 'unsigned char *' [-Wformat]
612 | BT_DBG("Unsupported protocol header 0x%02x", hdr);
| ~~~~ ^~~
| %2s
include/net/bluetooth/bluetooth.h:287:47: note: expanded from macro 'BT_DBG'
287 | #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:641:38: note: expanded from macro 'pr_debug'
641 | no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:134:18: note: expanded from macro 'no_printk'
134 | _printk(fmt, ##__VA_ARGS__); \
| ~~~ ^~~~~~~~~~~
1 warning generated.
vim +612 net/bluetooth/hidp/core.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 588
91f5cca3d1b434 Andrew Morton 2008-02-05 589 static void hidp_recv_intr_frame(struct hidp_session *session,
91f5cca3d1b434 Andrew Morton 2008-02-05 590 struct sk_buff *skb)
^1da177e4c3f41 Linus Torvalds 2005-04-16 591 {
afd2c613d3369f jiale yao 2026-07-19 592 unsigned char *hdr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 593
093dabb4f1aff9 Kai Ye 2021-06-03 594 BT_DBG("session %p skb %p len %u", session, skb, skb->len);
^1da177e4c3f41 Linus Torvalds 2005-04-16 595
afd2c613d3369f jiale yao 2026-07-19 596 hdr = skb_pull_data(skb, 1);
afd2c613d3369f jiale yao 2026-07-19 597 if (!hdr)
afd2c613d3369f jiale yao 2026-07-19 598 return;
^1da177e4c3f41 Linus Torvalds 2005-04-16 599
afd2c613d3369f jiale yao 2026-07-19 600 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 601 hidp_set_timer(session);
e1aaadd4d8162a Marcel Holtmann 2007-02-17 602
^1da177e4c3f41 Linus Torvalds 2005-04-16 603 if (session->input)
^1da177e4c3f41 Linus Torvalds 2005-04-16 604 hidp_input_report(session, skb);
e1aaadd4d8162a Marcel Holtmann 2007-02-17 605
e1aaadd4d8162a Marcel Holtmann 2007-02-17 606 if (session->hid) {
a4b1b5877b514b David Rheinsberg 2013-12-19 607 hidp_process_report(session, HID_INPUT_REPORT,
a4b1b5877b514b David Rheinsberg 2013-12-19 608 skb->data, skb->len, 1);
e1aaadd4d8162a Marcel Holtmann 2007-02-17 609 BT_DBG("report len %d", skb->len);
e1aaadd4d8162a Marcel Holtmann 2007-02-17 610 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 611 } else {
^1da177e4c3f41 Linus Torvalds 2005-04-16 @612 BT_DBG("Unsupported protocol header 0x%02x", hdr);
^1da177e4c3f41 Linus Torvalds 2005-04-16 613 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 614
^1da177e4c3f41 Linus Torvalds 2005-04-16 615 kfree_skb(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 616 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 617
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-08-16 2:20 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-17 15:32 [PATCH] Bluetooth: HIDP: add missing length check for incoming frames Jiale Yao
2026-07-17 15:40 ` Luiz Augusto von Dentz
2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao
2026-07-20 19:47 ` Luiz Augusto von Dentz
2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao
2026-07-22 0:06 ` Muhammad Bilal
2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot
2026-08-16 2:19 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®