Re: [PATCH 0/2] Bluetooth: HIDP: validate short receive frames

[email protected] Fri, 24 Jul 2026 19:00:08 +0000

Newsgroups	org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<178491960889.3273549.17393254757476094302.git-patchwork-notify@kernel.org>

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Thu, 23 Jul 2026 12:28:05 +0900 you wrote:
> The HIDP control and interrupt receive paths assume that every L2CAP SDU
> contains a transaction header. The raw-report return path also assumes that
> a numbered DATA response contains a report ID. Both assumptions allow a
> connected peer to make HIDP consume data beyond the logical skb boundary.
> 
> The tests used two BlueZ 5.87 btvirt BR/EDR controllers, real L2CAP PSM
> 0x11/0x13 channels, HIDPCONNADD, and HIDIOCGFEATURE on bluetooth.git at
> df541cd485ff. The series also applies without changes to bluetooth-next at
> 6f55ad8fb0ac.
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: HIDP: reject frames without a transaction header
    https://git.kernel.org/bluetooth/bluetooth-next/c/678c435909f2
  - [2/2] Bluetooth: HIDP: validate numbered report payloads
    https://git.kernel.org/bluetooth/bluetooth-next/c/883532b7d4eb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html