* [PATCH] Bluetooth: HIDP: add missing length check for incoming frames
@ 2026-07-17 15:32 Jiale Yao
2026-07-17 15:40 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 8+ messages in thread
From: Jiale Yao @ 2026-07-17 15:32 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, Jiale Yao, Tim Bird,
Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth,
linux-kernel
In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
read without verifying that skb->len >= 1. A zero-length L2CAP PDU
delivered via the HIDP control or interrupt channel causes an
out-of-bounds read.
Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
parsing") which addressed the same class of bug in BNEP.
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
net/bluetooth/hidp/core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0e24c5e2955e..6c7da8aca732 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+ if (!pskb_may_pull(skb, 1))
+ return;
hdr = skb->data[0];
skb_pull(skb, 1);
@@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+ if (!pskb_may_pull(skb, 1))
+ return;
hdr = skb->data[0];
skb_pull(skb, 1);
--
2.34.1
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-17 15:32 [PATCH] Bluetooth: HIDP: add missing length check for incoming frames Jiale Yao @ 2026-07-17 15:40 ` Luiz Augusto von Dentz 2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao 0 siblings, 1 reply; 8+ messages in thread From: Luiz Augusto von Dentz @ 2026-07-17 15:40 UTC (permalink / raw) To: Jiale Yao Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel Hi, On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote: > > In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > read without verifying that skb->len >= 1. A zero-length L2CAP PDU > delivered via the HIDP control or interrupt channel causes an > out-of-bounds read. > > Add pskb_may_pull(skb, 1) guards before both reads, matching the fix > in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before > parsing") which addressed the same class of bug in BNEP. > > Assisted-by: Claude:deepseek-v4-pro > Signed-off-by: Jiale Yao <yaojiale02@163.com> > --- > net/bluetooth/hidp/core.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > index 0e24c5e2955e..6c7da8aca732 100644 > --- a/net/bluetooth/hidp/core.c > +++ b/net/bluetooth/hidp/core.c > @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > + if (!pskb_may_pull(skb, 1)) > + return; We can probably replace this with skb_pull_data. > hdr = skb->data[0]; > skb_pull(skb, 1); > > @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session, > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > + if (!pskb_may_pull(skb, 1)) > + return; Ditto. > hdr = skb->data[0]; > skb_pull(skb, 1); > > -- > 2.34.1 > -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-17 15:40 ` Luiz Augusto von Dentz @ 2026-07-19 5:37 ` jiale yao 2026-07-20 19:47 ` Luiz Augusto von Dentz ` (2 more replies) 0 siblings, 3 replies; 8+ messages in thread From: jiale yao @ 2026-07-19 5:37 UTC (permalink / raw) To: Luiz Augusto von Dentz Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is read without verifying that skb->len >= 1. A zero-length L2CAP PDU delivered via the HIDP control or interrupt channel causes an out-of-bounds read. Use skb_pull_data(skb, 1) which combines the length check and pull in one operation, matching the existing pattern in hidp_input_report() and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before parsing") which addressed the same class of bug in BNEP. Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <yaojiale02@163.com> --- net/bluetooth/hidp/core.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index 0e24c5e2955e..bb61602b02e1 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, static void hidp_recv_ctrl_frame(struct hidp_session *session, struct sk_buff *skb) { - unsigned char hdr, type, param; + unsigned char *hdr; + unsigned char type, param; int free_skb = 1; BT_DBG("session %p skb %p len %u", session, skb, skb->len); - hdr = skb->data[0]; - skb_pull(skb, 1); + hdr = skb_pull_data(skb, 1); + if (!hdr) + return; - type = hdr & HIDP_HEADER_TRANS_MASK; - param = hdr & HIDP_HEADER_PARAM_MASK; + type = *hdr & HIDP_HEADER_TRANS_MASK; + param = *hdr & HIDP_HEADER_PARAM_MASK; switch (type) { case HIDP_TRANS_HANDSHAKE: @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, static void hidp_recv_intr_frame(struct hidp_session *session, struct sk_buff *skb) { - unsigned char hdr; + unsigned char *hdr; BT_DBG("session %p skb %p len %u", session, skb, skb->len); - hdr = skb->data[0]; - skb_pull(skb, 1); + hdr = skb_pull_data(skb, 1); + if (!hdr) + return; - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { hidp_set_timer(session); if (session->input) -- 2.34.1 At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: >Hi, > >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote: >> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU >> delivered via the HIDP control or interrupt channel causes an >> out-of-bounds read. >> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before >> parsing") which addressed the same class of bug in BNEP. >> >> Assisted-by: Claude:deepseek-v4-pro >> Signed-off-by: Jiale Yao <yaojiale02@163.com> >> --- >> net/bluetooth/hidp/core.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c >> index 0e24c5e2955e..6c7da8aca732 100644 >> --- a/net/bluetooth/hidp/core.c >> +++ b/net/bluetooth/hidp/core.c >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> + if (!pskb_may_pull(skb, 1)) >> + return; > >We can probably replace this with skb_pull_data. > >> hdr = skb->data[0]; >> skb_pull(skb, 1); >> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session, >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> + if (!pskb_may_pull(skb, 1)) >> + return; > >Ditto. > >> hdr = skb->data[0]; >> skb_pull(skb, 1); >> >> -- >> 2.34.1 >> > > >-- >Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao @ 2026-07-20 19:47 ` Luiz Augusto von Dentz 2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao 2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot 2026-08-16 2:19 ` kernel test robot 2 siblings, 1 reply; 8+ messages in thread From: Luiz Augusto von Dentz @ 2026-07-20 19:47 UTC (permalink / raw) To: jiale yao Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel Hi, On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote: > > > > > > > > In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > read without verifying that skb->len >= 1. A zero-length L2CAP PDU > delivered via the HIDP control or interrupt channel causes an > out-of-bounds read. > > Use skb_pull_data(skb, 1) which combines the length check and pull > in one operation, matching the existing pattern in hidp_input_report() > and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short > frames before parsing") which addressed the same class of bug in BNEP. > > Assisted-by: Claude:deepseek-v4-pro > Signed-off-by: Jiale Yao <yaojiale02@163.com> > --- > net/bluetooth/hidp/core.c | 21 ++++++++++++--------- > 1 file changed, 12 insertions(+), 9 deletions(-) > > diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > index 0e24c5e2955e..bb61602b02e1 100644 > --- a/net/bluetooth/hidp/core.c > +++ b/net/bluetooth/hidp/core.c > @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, > static void hidp_recv_ctrl_frame(struct hidp_session *session, > struct sk_buff *skb) > { > - unsigned char hdr, type, param; > + unsigned char *hdr; > + unsigned char type, param; > int free_skb = 1; > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > - hdr = skb->data[0]; > - skb_pull(skb, 1); > + hdr = skb_pull_data(skb, 1); > + if (!hdr) > + return; https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com It seems that by early returning we are leaking the skb. > > - type = hdr & HIDP_HEADER_TRANS_MASK; > - param = hdr & HIDP_HEADER_PARAM_MASK; > + type = *hdr & HIDP_HEADER_TRANS_MASK; > + param = *hdr & HIDP_HEADER_PARAM_MASK; > > switch (type) { > case HIDP_TRANS_HANDSHAKE: > @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > static void hidp_recv_intr_frame(struct hidp_session *session, > struct sk_buff *skb) > { > - unsigned char hdr; > + unsigned char *hdr; > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > - hdr = skb->data[0]; > - skb_pull(skb, 1); > + hdr = skb_pull_data(skb, 1); > + if (!hdr) > + return; > > - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > hidp_set_timer(session); > > if (session->input) > -- > 2.34.1 > > > > > > > > > > > > > At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: > >Hi, > > > >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote: > >> > >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU > >> delivered via the HIDP control or interrupt channel causes an > >> out-of-bounds read. > >> > >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix > >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before > >> parsing") which addressed the same class of bug in BNEP. > >> > >> Assisted-by: Claude:deepseek-v4-pro > >> Signed-off-by: Jiale Yao <yaojiale02@163.com> > >> --- > >> net/bluetooth/hidp/core.c | 4 ++++ > >> 1 file changed, 4 insertions(+) > >> > >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > >> index 0e24c5e2955e..6c7da8aca732 100644 > >> --- a/net/bluetooth/hidp/core.c > >> +++ b/net/bluetooth/hidp/core.c > >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > >> > >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> > >> + if (!pskb_may_pull(skb, 1)) > >> + return; > > > >We can probably replace this with skb_pull_data. > > > >> hdr = skb->data[0]; > >> skb_pull(skb, 1); > >> > >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session, > >> > >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> > >> + if (!pskb_may_pull(skb, 1)) > >> + return; > > > >Ditto. > > > >> hdr = skb->data[0]; > >> skb_pull(skb, 1); > >> > >> -- > >> 2.34.1 > >> > > > > > >-- > >Luiz Augusto von Dentz -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re:Re: Re: [PATCH v3] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-20 19:47 ` Luiz Augusto von Dentz @ 2026-07-21 5:54 ` jiale yao 2026-07-22 0:06 ` Muhammad Bilal 0 siblings, 1 reply; 8+ messages in thread From: jiale yao @ 2026-07-21 5:54 UTC (permalink / raw) To: Luiz Augusto von Dentz Cc: Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is read without verifying that skb->len >= 1. A zero-length L2CAP PDU delivered via the HIDP control or interrupt channel causes an out-of-bounds read. Use skb_pull_data(skb, 1) which combines the length check and pull in one operation, matching the existing pattern in hidp_input_report() and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before parsing") which addressed the same class of bug in BNEP. Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <yaojiale02@163.com> --- net/bluetooth/hidp/core.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index 0e24c5e2955e..e29fe66f01d4 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, static void hidp_recv_ctrl_frame(struct hidp_session *session, struct sk_buff *skb) { - unsigned char hdr, type, param; + unsigned char *hdr; + unsigned char type, param; int free_skb = 1; BT_DBG("session %p skb %p len %u", session, skb, skb->len); - hdr = skb->data[0]; - skb_pull(skb, 1); + hdr = skb_pull_data(skb, 1); + if (!hdr) + goto failed; - type = hdr & HIDP_HEADER_TRANS_MASK; - param = hdr & HIDP_HEADER_PARAM_MASK; + type = *hdr & HIDP_HEADER_TRANS_MASK; + param = *hdr & HIDP_HEADER_PARAM_MASK; switch (type) { case HIDP_TRANS_HANDSHAKE: @@ -590,6 +592,7 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, break; } +failed: if (free_skb) kfree_skb(skb); } @@ -597,14 +600,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, static void hidp_recv_intr_frame(struct hidp_session *session, struct sk_buff *skb) { - unsigned char hdr; + unsigned char *hdr; BT_DBG("session %p skb %p len %u", session, skb, skb->len); - hdr = skb->data[0]; - skb_pull(skb, 1); + hdr = skb_pull_data(skb, 1); + if (!hdr) + goto failed; - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { hidp_set_timer(session); if (session->input) @@ -616,9 +620,10 @@ static void hidp_recv_intr_frame(struct hidp_session *session, BT_DBG("report len %d", skb->len); } } else { - BT_DBG("Unsupported protocol header 0x%02x", hdr); + BT_DBG("Unsupported protocol header 0x%02x", *hdr); } +failed: kfree_skb(skb); } -- 2.34.1 At 2026-07-21 03:47:21, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: >Hi, > >On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote: >> >> >> >> >> >> >> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU >> delivered via the HIDP control or interrupt channel causes an >> out-of-bounds read. >> >> Use skb_pull_data(skb, 1) which combines the length check and pull >> in one operation, matching the existing pattern in hidp_input_report() >> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short >> frames before parsing") which addressed the same class of bug in BNEP. >> >> Assisted-by: Claude:deepseek-v4-pro >> Signed-off-by: Jiale Yao <yaojiale02@163.com> >> --- >> net/bluetooth/hidp/core.c | 21 ++++++++++++--------- >> 1 file changed, 12 insertions(+), 9 deletions(-) >> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c >> index 0e24c5e2955e..bb61602b02e1 100644 >> --- a/net/bluetooth/hidp/core.c >> +++ b/net/bluetooth/hidp/core.c >> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, >> static void hidp_recv_ctrl_frame(struct hidp_session *session, >> struct sk_buff *skb) >> { >> - unsigned char hdr, type, param; >> + unsigned char *hdr; >> + unsigned char type, param; >> int free_skb = 1; >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> - hdr = skb->data[0]; >> - skb_pull(skb, 1); >> + hdr = skb_pull_data(skb, 1); >> + if (!hdr) >> + return; > >https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com > >It seems that by early returning we are leaking the skb. > >> >> - type = hdr & HIDP_HEADER_TRANS_MASK; >> - param = hdr & HIDP_HEADER_PARAM_MASK; >> + type = *hdr & HIDP_HEADER_TRANS_MASK; >> + param = *hdr & HIDP_HEADER_PARAM_MASK; >> >> switch (type) { >> case HIDP_TRANS_HANDSHAKE: >> @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, >> static void hidp_recv_intr_frame(struct hidp_session *session, >> struct sk_buff *skb) >> { >> - unsigned char hdr; >> + unsigned char *hdr; >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> - hdr = skb->data[0]; >> - skb_pull(skb, 1); >> + hdr = skb_pull_data(skb, 1); >> + if (!hdr) >> + return; >> >> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { >> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { >> hidp_set_timer(session); >> >> if (session->input) >> -- >> 2.34.1 >> >> >> >> >> >> >> >> >> >> >> >> >> At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: >> >Hi, >> > >> >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote: >> >> >> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is >> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU >> >> delivered via the HIDP control or interrupt channel causes an >> >> out-of-bounds read. >> >> >> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix >> >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before >> >> parsing") which addressed the same class of bug in BNEP. >> >> >> >> Assisted-by: Claude:deepseek-v4-pro >> >> Signed-off-by: Jiale Yao <yaojiale02@163.com> >> >> --- >> >> net/bluetooth/hidp/core.c | 4 ++++ >> >> 1 file changed, 4 insertions(+) >> >> >> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c >> >> index 0e24c5e2955e..6c7da8aca732 100644 >> >> --- a/net/bluetooth/hidp/core.c >> >> +++ b/net/bluetooth/hidp/core.c >> >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, >> >> >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> >> >> + if (!pskb_may_pull(skb, 1)) >> >> + return; >> > >> >We can probably replace this with skb_pull_data. >> > >> >> hdr = skb->data[0]; >> >> skb_pull(skb, 1); >> >> >> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session, >> >> >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); >> >> >> >> + if (!pskb_may_pull(skb, 1)) >> >> + return; >> > >> >Ditto. >> > >> >> hdr = skb->data[0]; >> >> skb_pull(skb, 1); >> >> >> >> -- >> >> 2.34.1 >> >> >> > >> > >> >-- >> >Luiz Augusto von Dentz > > > >-- >Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re: Re: [PATCH v3] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao @ 2026-07-22 0:06 ` Muhammad Bilal 0 siblings, 0 replies; 8+ messages in thread From: Muhammad Bilal @ 2026-07-22 0:06 UTC (permalink / raw) To: jiale yao Cc: Luiz Augusto von Dentz, Marcel Holtmann, Tim Bird, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel Hi Jiale, Looks correct. Both goto failed paths free the skb properly now, and the intr_frame goto also avoids a NULL hdr deref. Reviewed-by: Muhammad Bilal <meatuni001@gmail.com> Thanks, Muhammad Bilal On Tue, Jul 21, 2026 at 10:55 AM jiale yao <19888972804@163.com> wrote: > > In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > read without verifying that skb->len >= 1. A zero-length L2CAP PDU > delivered via the HIDP control or interrupt channel causes an > out-of-bounds read. > > Use skb_pull_data(skb, 1) which combines the length check and pull > in one operation, matching the existing pattern in hidp_input_report() > and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short > frames before parsing") which addressed the same class of bug in BNEP. > > Assisted-by: Claude:deepseek-v4-pro > Signed-off-by: Jiale Yao <yaojiale02@163.com> > --- > net/bluetooth/hidp/core.c | 25 +++++++++++++++---------- > 1 file changed, 15 insertions(+), 10 deletions(-) > > diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > index 0e24c5e2955e..e29fe66f01d4 100644 > --- a/net/bluetooth/hidp/core.c > +++ b/net/bluetooth/hidp/core.c > @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, > static void hidp_recv_ctrl_frame(struct hidp_session *session, > struct sk_buff *skb) > { > - unsigned char hdr, type, param; > + unsigned char *hdr; > + unsigned char type, param; > int free_skb = 1; > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > - hdr = skb->data[0]; > - skb_pull(skb, 1); > + hdr = skb_pull_data(skb, 1); > + if (!hdr) > + goto failed; > > - type = hdr & HIDP_HEADER_TRANS_MASK; > - param = hdr & HIDP_HEADER_PARAM_MASK; > + type = *hdr & HIDP_HEADER_TRANS_MASK; > + param = *hdr & HIDP_HEADER_PARAM_MASK; > > switch (type) { > case HIDP_TRANS_HANDSHAKE: > @@ -590,6 +592,7 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > break; > } > > +failed: > if (free_skb) > kfree_skb(skb); > } > @@ -597,14 +600,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > static void hidp_recv_intr_frame(struct hidp_session *session, > struct sk_buff *skb) > { > - unsigned char hdr; > + unsigned char *hdr; > > BT_DBG("session %p skb %p len %u", session, skb, skb->len); > > - hdr = skb->data[0]; > - skb_pull(skb, 1); > + hdr = skb_pull_data(skb, 1); > + if (!hdr) > + goto failed; > > - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > hidp_set_timer(session); > > if (session->input) > @@ -616,9 +620,10 @@ static void hidp_recv_intr_frame(struct hidp_session *session, > BT_DBG("report len %d", skb->len); > } > } else { > - BT_DBG("Unsupported protocol header 0x%02x", hdr); > + BT_DBG("Unsupported protocol header 0x%02x", *hdr); > } > > +failed: > kfree_skb(skb); > } > > -- > 2.34.1 > > > > > > > > At 2026-07-21 03:47:21, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: > >Hi, > > > >On Sun, Jul 19, 2026 at 1:38 AM jiale yao <19888972804@163.com> wrote: > >> > >> > >> > >> > >> > >> > >> > >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU > >> delivered via the HIDP control or interrupt channel causes an > >> out-of-bounds read. > >> > >> Use skb_pull_data(skb, 1) which combines the length check and pull > >> in one operation, matching the existing pattern in hidp_input_report() > >> and the fix in commit 6770d3a8acdf ("Bluetooth: bnep: reject short > >> frames before parsing") which addressed the same class of bug in BNEP. > >> > >> Assisted-by: Claude:deepseek-v4-pro > >> Signed-off-by: Jiale Yao <yaojiale02@163.com> > >> --- > >> net/bluetooth/hidp/core.c | 21 ++++++++++++--------- > >> 1 file changed, 12 insertions(+), 9 deletions(-) > >> > >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > >> index 0e24c5e2955e..bb61602b02e1 100644 > >> --- a/net/bluetooth/hidp/core.c > >> +++ b/net/bluetooth/hidp/core.c > >> @@ -560,16 +560,18 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, > >> static void hidp_recv_ctrl_frame(struct hidp_session *session, > >> struct sk_buff *skb) > >> { > >> - unsigned char hdr, type, param; > >> + unsigned char *hdr; > >> + unsigned char type, param; > >> int free_skb = 1; > >> > >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> > >> - hdr = skb->data[0]; > >> - skb_pull(skb, 1); > >> + hdr = skb_pull_data(skb, 1); > >> + if (!hdr) > >> + return; > > > >https://sashiko.dev/#/patchset/20260717153238.2002330-1-yaojiale02%40163.com > > > >It seems that by early returning we are leaking the skb. > > > >> > >> - type = hdr & HIDP_HEADER_TRANS_MASK; > >> - param = hdr & HIDP_HEADER_PARAM_MASK; > >> + type = *hdr & HIDP_HEADER_TRANS_MASK; > >> + param = *hdr & HIDP_HEADER_PARAM_MASK; > >> > >> switch (type) { > >> case HIDP_TRANS_HANDSHAKE: > >> @@ -597,14 +599,15 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > >> static void hidp_recv_intr_frame(struct hidp_session *session, > >> struct sk_buff *skb) > >> { > >> - unsigned char hdr; > >> + unsigned char *hdr; > >> > >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> > >> - hdr = skb->data[0]; > >> - skb_pull(skb, 1); > >> + hdr = skb_pull_data(skb, 1); > >> + if (!hdr) > >> + return; > >> > >> - if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > >> + if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { > >> hidp_set_timer(session); > >> > >> if (session->input) > >> -- > >> 2.34.1 > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> At 2026-07-17 23:40:11, "Luiz Augusto von Dentz" <luiz.dentz@gmail.com> wrote: > >> >Hi, > >> > > >> >On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@163.com> wrote: > >> >> > >> >> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is > >> >> read without verifying that skb->len >= 1. A zero-length L2CAP PDU > >> >> delivered via the HIDP control or interrupt channel causes an > >> >> out-of-bounds read. > >> >> > >> >> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix > >> >> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before > >> >> parsing") which addressed the same class of bug in BNEP. > >> >> > >> >> Assisted-by: Claude:deepseek-v4-pro > >> >> Signed-off-by: Jiale Yao <yaojiale02@163.com> > >> >> --- > >> >> net/bluetooth/hidp/core.c | 4 ++++ > >> >> 1 file changed, 4 insertions(+) > >> >> > >> >> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c > >> >> index 0e24c5e2955e..6c7da8aca732 100644 > >> >> --- a/net/bluetooth/hidp/core.c > >> >> +++ b/net/bluetooth/hidp/core.c > >> >> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session, > >> >> > >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> >> > >> >> + if (!pskb_may_pull(skb, 1)) > >> >> + return; > >> > > >> >We can probably replace this with skb_pull_data. > >> > > >> >> hdr = skb->data[0]; > >> >> skb_pull(skb, 1); > >> >> > >> >> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session, > >> >> > >> >> BT_DBG("session %p skb %p len %u", session, skb, skb->len); > >> >> > >> >> + if (!pskb_may_pull(skb, 1)) > >> >> + return; > >> > > >> >Ditto. > >> > > >> >> hdr = skb->data[0]; > >> >> skb_pull(skb, 1); > >> >> > >> >> -- > >> >> 2.34.1 > >> >> > >> > > >> > > >> >-- > >> >Luiz Augusto von Dentz > > > > > > > >-- > >Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao 2026-07-20 19:47 ` Luiz Augusto von Dentz @ 2026-08-14 4:27 ` kernel test robot 2026-08-16 2:19 ` kernel test robot 2 siblings, 0 replies; 8+ messages in thread From: kernel test robot @ 2026-08-14 4:27 UTC (permalink / raw) To: jiale yao, Luiz Augusto von Dentz Cc: oe-kbuild-all, Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel Hi jiale, kernel test robot noticed the following build warnings: [auto build test WARNING on kees/for-next/pstore] [also build test WARNING on kees/for-next/kspp] [cannot apply to bluetooth-next/master bluetooth/master linus/master v7.2-rc7 next-20260812] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/jiale-yao/Re-Re-PATCH-v2-Bluetooth-HIDP-add-missing-length-check-for-incoming-frames/20260814-100503 base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore patch link: https://lore.kernel.org/r/220b6be5.d3f.19f78e165aa.Coremail.19888972804%40163.com patch subject: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260814/202608141113.WMJnrfnI-lkp@intel.com/config) compiler: powerpc64-linux-gcc (GCC) 16.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260814/202608141113.WMJnrfnI-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202608141113.WMJnrfnI-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/asm-generic/bug.h:31, from arch/powerpc/include/asm/bug.h:116, from include/linux/bug.h:5, from include/linux/thread_info.h:13, from include/asm-generic/preempt.h:5, from arch/powerpc/include/asm/preempt.h:5, from include/linux/preempt.h:79, from include/linux/spinlock.h:56, from include/linux/kref.h:16, from net/bluetooth/hidp/core.c:24: net/bluetooth/hidp/core.c: In function 'hidp_recv_intr_frame': >> net/bluetooth/hidp/core.c:612:24: warning: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'unsigned char *' [-Wformat=] 612 | BT_DBG("Unsupported protocol header 0x%02x", hdr); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:401:21: note: in definition of macro 'pr_fmt' 401 | #define pr_fmt(fmt) fmt | ^~~ include/linux/dynamic_debug.h:259:9: note: in expansion of macro '__dynamic_func_call_cls' 259 | __dynamic_func_call_cls(__UNIQUE_ID(ddebug), cls, fmt, func, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/dynamic_debug.h:261:9: note: in expansion of macro '_dynamic_func_call_cls' 261 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/dynamic_debug.h:280:9: note: in expansion of macro '_dynamic_func_call' 280 | _dynamic_func_call(fmt, __dynamic_pr_debug, \ | ^~~~~~~~~~~~~~~~~~ include/linux/printk.h:635:9: note: in expansion of macro 'dynamic_pr_debug' 635 | dynamic_pr_debug(fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~ include/net/bluetooth/bluetooth.h:287:33: note: in expansion of macro 'pr_debug' 287 | #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__) | ^~~~~~~~ net/bluetooth/hidp/core.c:612:17: note: in expansion of macro 'BT_DBG' 612 | BT_DBG("Unsupported protocol header 0x%02x", hdr); | ^~~~~~ net/bluetooth/hidp/core.c:612:58: note: format string is defined here 612 | BT_DBG("Unsupported protocol header 0x%02x", hdr); | ~~~^ | | | unsigned int | %02hhn vim +612 net/bluetooth/hidp/core.c ^1da177e4c3f415 Linus Torvalds 2005-04-16 588 91f5cca3d1b4341 Andrew Morton 2008-02-05 589 static void hidp_recv_intr_frame(struct hidp_session *session, 91f5cca3d1b4341 Andrew Morton 2008-02-05 590 struct sk_buff *skb) ^1da177e4c3f415 Linus Torvalds 2005-04-16 591 { afd2c613d3369fb jiale yao 2026-07-19 592 unsigned char *hdr; ^1da177e4c3f415 Linus Torvalds 2005-04-16 593 093dabb4f1aff98 Kai Ye 2021-06-03 594 BT_DBG("session %p skb %p len %u", session, skb, skb->len); ^1da177e4c3f415 Linus Torvalds 2005-04-16 595 afd2c613d3369fb jiale yao 2026-07-19 596 hdr = skb_pull_data(skb, 1); afd2c613d3369fb jiale yao 2026-07-19 597 if (!hdr) afd2c613d3369fb jiale yao 2026-07-19 598 return; ^1da177e4c3f415 Linus Torvalds 2005-04-16 599 afd2c613d3369fb jiale yao 2026-07-19 600 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 601 hidp_set_timer(session); e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 602 ^1da177e4c3f415 Linus Torvalds 2005-04-16 603 if (session->input) ^1da177e4c3f415 Linus Torvalds 2005-04-16 604 hidp_input_report(session, skb); e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 605 e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 606 if (session->hid) { a4b1b5877b514b2 David Rheinsberg 2013-12-19 607 hidp_process_report(session, HID_INPUT_REPORT, a4b1b5877b514b2 David Rheinsberg 2013-12-19 608 skb->data, skb->len, 1); e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 609 BT_DBG("report len %d", skb->len); e1aaadd4d8162a2 Marcel Holtmann 2007-02-17 610 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 611 } else { ^1da177e4c3f415 Linus Torvalds 2005-04-16 @612 BT_DBG("Unsupported protocol header 0x%02x", hdr); ^1da177e4c3f415 Linus Torvalds 2005-04-16 613 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 614 ^1da177e4c3f415 Linus Torvalds 2005-04-16 615 kfree_skb(skb); ^1da177e4c3f415 Linus Torvalds 2005-04-16 616 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 617 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames 2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao 2026-07-20 19:47 ` Luiz Augusto von Dentz 2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot @ 2026-08-16 2:19 ` kernel test robot 2 siblings, 0 replies; 8+ messages in thread From: kernel test robot @ 2026-08-16 2:19 UTC (permalink / raw) To: jiale yao, Luiz Augusto von Dentz Cc: llvm, oe-kbuild-all, Marcel Holtmann, Tim Bird, Muhammad Bilal, Kees Cook, Michael Bommarito, linux-bluetooth, linux-kernel Hi jiale, kernel test robot noticed the following build warnings: [auto build test WARNING on kees/for-next/pstore] [also build test WARNING on kees/for-next/kspp] [cannot apply to bluetooth-next/master bluetooth/master linus/master v7.2-rc7 next-20260814] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/jiale-yao/Re-Re-PATCH-v2-Bluetooth-HIDP-add-missing-length-check-for-incoming-frames/20260814-100503 base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore patch link: https://lore.kernel.org/r/220b6be5.d3f.19f78e165aa.Coremail.19888972804%40163.com patch subject: Re:Re: [PATCH v2] Bluetooth: HIDP: add missing length check for incoming frames config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260816/202608161044.9x6CmhDO-lkp@intel.com/config) compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 844a18e753e822736c9805ab779144b647a2c186) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260816/202608161044.9x6CmhDO-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202608161044.9x6CmhDO-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/bluetooth/hidp/core.c:612:48: warning: format specifies type 'unsigned int' but the argument has type 'unsigned char *' [-Wformat] 612 | BT_DBG("Unsupported protocol header 0x%02x", hdr); | ~~~~ ^~~ | %2s include/net/bluetooth/bluetooth.h:287:47: note: expanded from macro 'BT_DBG' 287 | #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__) | ~~~ ^~~~~~~~~~~ include/linux/printk.h:641:38: note: expanded from macro 'pr_debug' 641 | no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__) | ~~~ ^~~~~~~~~~~ include/linux/printk.h:134:18: note: expanded from macro 'no_printk' 134 | _printk(fmt, ##__VA_ARGS__); \ | ~~~ ^~~~~~~~~~~ 1 warning generated. vim +612 net/bluetooth/hidp/core.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 588 91f5cca3d1b434 Andrew Morton 2008-02-05 589 static void hidp_recv_intr_frame(struct hidp_session *session, 91f5cca3d1b434 Andrew Morton 2008-02-05 590 struct sk_buff *skb) ^1da177e4c3f41 Linus Torvalds 2005-04-16 591 { afd2c613d3369f jiale yao 2026-07-19 592 unsigned char *hdr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 593 093dabb4f1aff9 Kai Ye 2021-06-03 594 BT_DBG("session %p skb %p len %u", session, skb, skb->len); ^1da177e4c3f41 Linus Torvalds 2005-04-16 595 afd2c613d3369f jiale yao 2026-07-19 596 hdr = skb_pull_data(skb, 1); afd2c613d3369f jiale yao 2026-07-19 597 if (!hdr) afd2c613d3369f jiale yao 2026-07-19 598 return; ^1da177e4c3f41 Linus Torvalds 2005-04-16 599 afd2c613d3369f jiale yao 2026-07-19 600 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 601 hidp_set_timer(session); e1aaadd4d8162a Marcel Holtmann 2007-02-17 602 ^1da177e4c3f41 Linus Torvalds 2005-04-16 603 if (session->input) ^1da177e4c3f41 Linus Torvalds 2005-04-16 604 hidp_input_report(session, skb); e1aaadd4d8162a Marcel Holtmann 2007-02-17 605 e1aaadd4d8162a Marcel Holtmann 2007-02-17 606 if (session->hid) { a4b1b5877b514b David Rheinsberg 2013-12-19 607 hidp_process_report(session, HID_INPUT_REPORT, a4b1b5877b514b David Rheinsberg 2013-12-19 608 skb->data, skb->len, 1); e1aaadd4d8162a Marcel Holtmann 2007-02-17 609 BT_DBG("report len %d", skb->len); e1aaadd4d8162a Marcel Holtmann 2007-02-17 610 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 611 } else { ^1da177e4c3f41 Linus Torvalds 2005-04-16 @612 BT_DBG("Unsupported protocol header 0x%02x", hdr); ^1da177e4c3f41 Linus Torvalds 2005-04-16 613 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 614 ^1da177e4c3f41 Linus Torvalds 2005-04-16 615 kfree_skb(skb); ^1da177e4c3f41 Linus Torvalds 2005-04-16 616 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 617 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-08-16 2:20 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-07-17 15:32 [PATCH] Bluetooth: HIDP: add missing length check for incoming frames Jiale Yao 2026-07-17 15:40 ` Luiz Augusto von Dentz 2026-07-19 5:37 ` Re:Re: [PATCH v2] " jiale yao 2026-07-20 19:47 ` Luiz Augusto von Dentz 2026-07-21 5:54 ` Re:Re: Re: [PATCH v3] " jiale yao 2026-07-22 0:06 ` Muhammad Bilal 2026-08-14 4:27 ` Re:Re: [PATCH v2] " kernel test robot 2026-08-16 2:19 ` kernel test robot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®