Re: [PATCH] Bluetooth: HIDP: add missing length check for incoming frames

[Luiz Augusto von Dentz]

Hi,

On Fri, Jul 17, 2026 at 11:33 AM Jiale Yao <yaojiale02@xxxxxxx> wrote:
>
> In hidp_recv_ctrl_frame() and hidp_recv_intr_frame(), skb->data[0] is
> read without verifying that skb->len >= 1.  A zero-length L2CAP PDU
> delivered via the HIDP control or interrupt channel causes an
> out-of-bounds read.
>
> Add pskb_may_pull(skb, 1) guards before both reads, matching the fix
> in commit 6770d3a8acdf ("Bluetooth: bnep: reject short frames before
> parsing") which addressed the same class of bug in BNEP.
>
> Assisted-by: Claude:deepseek-v4-pro
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  net/bluetooth/hidp/core.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
> index 0e24c5e2955e..6c7da8aca732 100644
> --- a/net/bluetooth/hidp/core.c
> +++ b/net/bluetooth/hidp/core.c
> @@ -565,6 +565,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
>
>         BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> +       if (!pskb_may_pull(skb, 1))
> +               return;

We can probably replace this with skb_pull_data.

>         hdr = skb->data[0];
>         skb_pull(skb, 1);
>
> @@ -601,6 +603,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
>
>         BT_DBG("session %p skb %p len %u", session, skb, skb->len);
>
> +       if (!pskb_may_pull(skb, 1))
> +               return;

Ditto.

>         hdr = skb->data[0];
>         skb_pull(skb, 1);
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz