From: Hui Peng <benquike@gmail.com>
To: marcel@holtmann.org, luiz.dentz@gmail.com
Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak
Date: Sat, 19 Sep 2026 22:17:41 +0000 [thread overview]
Message-ID: <20260919221741.3709254-1-benquike@gmail.com> (raw)
In hidp_recv_intr_frame() and hidp_recv_ctrl_frame()
(net/bluetooth/hidp/core.c), check skb->len >= 1 with pskb_may_pull()
before dereferencing skb->data[0] and skb_pull(skb, 1), and free any
stale session->report_return skb before overwriting it or when tearing
down the HIDP session.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index f5bdf9f1ca63..7fc1b3ae585f 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -321,6 +321,8 @@ static int hidp_get_raw_report(struct hid_device *hid,
err:
clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+ kfree_skb(session->report_return);
+ session->report_return = NULL;
mutex_unlock(&session->report_mutex);
return ret;
}
@@ -520,6 +522,9 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
int done_with_skb = 1;
BT_DBG("session %p skb %p len %u param 0x%02x", session, skb, skb->len, param);
+ if (skb->len < 1)
+ return 1;
+
switch (param) {
case HIDP_DATA_RTYPE_INPUT:
hidp_set_timer(session);
@@ -548,6 +553,7 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
(skb->len &&
session->waiting_report_number == skb->data[0])) {
/* hidp_get_raw_report() is waiting on this report. */
+ kfree_skb(session->report_return);
session->report_return = skb;
done_with_skb = 0;
clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
@@ -615,7 +621,7 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
if (session->input)
hidp_input_report(session, skb);
- if (session->hid) {
+ if (session->hid && skb->len >= 1) {
hidp_process_report(session, HID_INPUT_REPORT,
skb->data, skb->len, 1);
BT_DBG("report len %d", skb->len);
@@ -1000,6 +1006,7 @@ static void session_free(struct kref *ref)
hidp_session_dev_destroy(session);
skb_queue_purge(&session->ctrl_transmit);
skb_queue_purge(&session->intr_transmit);
+ kfree_skb(session->report_return);
fput(session->intr_sock->file);
fput(session->ctrl_sock->file);
if (session->conn)
reply other threads:[~2026-09-19 22:17 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260919221741.3709254-1-benquike@gmail.com \
--to=benquike@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®