[PATCH] Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

[PATCH] Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

[Hui Peng]

In hidp_recv_intr_frame() and hidp_recv_ctrl_frame()
(net/bluetooth/hidp/core.c), check skb->len >= 1 with pskb_may_pull()
before dereferencing skb->data[0] and skb_pull(skb, 1), and free any
stale session->report_return skb before overwriting it or when tearing
down the HIDP session.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index f5bdf9f1ca63..7fc1b3ae585f 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -321,6 +321,8 @@ static int hidp_get_raw_report(struct hid_device *hid,
 
 err:
 	clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+	kfree_skb(session->report_return);
+	session->report_return = NULL;
 	mutex_unlock(&session->report_mutex);
 	return ret;
 }
@@ -520,6 +522,9 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 	int done_with_skb = 1;
 	BT_DBG("session %p skb %p len %u param 0x%02x", session, skb, skb->len, param);
 
+	if (skb->len < 1)
+		return 1;
+
 	switch (param) {
 	case HIDP_DATA_RTYPE_INPUT:
 		hidp_set_timer(session);
@@ -548,6 +553,7 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 		    (skb->len &&
 		     session->waiting_report_number == skb->data[0])) {
 			/* hidp_get_raw_report() is waiting on this report. */
+			kfree_skb(session->report_return);
 			session->report_return = skb;
 			done_with_skb = 0;
 			clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
@@ -615,7 +621,7 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
 		if (session->input)
 			hidp_input_report(session, skb);
 
-		if (session->hid) {
+		if (session->hid && skb->len >= 1) {
 			hidp_process_report(session, HID_INPUT_REPORT,
 					    skb->data, skb->len, 1);
 			BT_DBG("report len %d", skb->len);
@@ -1000,6 +1006,7 @@ static void session_free(struct kref *ref)
 	hidp_session_dev_destroy(session);
 	skb_queue_purge(&session->ctrl_transmit);
 	skb_queue_purge(&session->intr_transmit);
+	kfree_skb(session->report_return);
 	fput(session->intr_sock->file);
 	fput(session->ctrl_sock->file);
 	if (session->conn)

RE: Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2515 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169458/

---Test result---

Test Summary:
CheckPatch                    PASS      0.70 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.30 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   PASS      27.92 seconds
CheckAllWarning               PASS      31.77 seconds
CheckSparse                   PASS      34.62 seconds
BuildKernel32                 PASS      27.96 seconds
CheckKernelLLVM               PASS      35.24 seconds
TestRunnerSetup               PASS      733.57 seconds
TestRunner_l2cap-tester       PASS      16.26 seconds
TestRunner_iso-tester         PASS      28.58 seconds
TestRunner_bnep-tester        PASS      9.31 seconds
TestRunner_mgmt-tester        FAIL      60.21 seconds
TestRunner_rfcomm-tester      PASS      4.82 seconds
TestRunner_sco-tester         PASS      7.56 seconds
TestRunner_ioctl-tester       PASS      4.65 seconds
TestRunner_mesh-tester        FAIL      7.83 seconds
TestRunner_smp-tester         PASS      4.33 seconds
TestRunner_userchan-tester    PASS      3.29 seconds
TestRunner_6lowpan-tester     PASS      4.39 seconds
IncrementalBuild              PASS      26.62 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

1: T1 Title exceeds max length (83>80): "Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak"
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.019 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.441 seconds
Mesh - Send cancel - 2                               Timed out    2.000 seconds


https://github.com/bluez/bluetooth-next/pull/801

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

[krzk]

On Sat, 19 Sep 2026 22:17:41 +0000, Hui Peng wrote:
> In hidp_recv_intr_frame() and hidp_recv_ctrl_frame()
> (net/bluetooth/hidp/core.c), check skb->len >= 1 with pskb_may_pull()
> before dereferencing skb->data[0] and skb_pull(skb, 1), and free any
> stale session->report_return skb before overwriting it or when tearing
> down the HIDP session.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof

Re: [PATCH] Bluetooth: hidp: fix out-of-bounds reads on short frames and report_return skb leak

[krzk]

On Sat, 19 Sep 2026 22:17:41 +0000, Hui Peng wrote:
> In hidp_recv_intr_frame() and hidp_recv_ctrl_frame()
> (net/bluetooth/hidp/core.c), check skb->len >= 1 with pskb_may_pull()
> before dereferencing skb->data[0] and skb_pull(skb, 1), and free any
> stale session->report_return skb before overwriting it or when tearing
> down the HIDP session.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof