CVE-2025-22408 AI-generated analysis
platform/packages/modules/Bluetooth, system/stack (avct, bnep, hid, rfcomm, sdp)
Across nine L2CAP send sites in eight Bluetooth stack files (AVCTP, BNEP, HID device, RFCOMM, SDP client and server), the failure-path log::warn no longer reads ->len from the BT_HDR buffer after L2CA_DataWrite. The length is now saved in a local before the call, or taken from the pointer difference already computed for it.
Root cause
At each affected site the code passes a BT_HDR* (p_buf, p_msg, p, hd_cb.pending_data) to L2CA_DataWrite. When the call does not return L2CAP_DW_SUCCESS, it logs `...->len` from that same buffer. Per the commit message, the preceding call may already have freed the buffer in exceptional cases, so the log statement reads freed memory. The pattern was present in avct_lcb_msg_ind, bnep_congestion_ind, bnepu_check_send_packet, hidd_check_config_done, rfc_send_buf_uih, rfc_check_send_cmd, process_service_attr_rsp, process_service_search and process_service_attr_req.
How the fix works
- system/stack/avct/avct_lcb_act.cc:avct_lcb_msg_ind - adds `uint16_t len = p_buf->len;` before L2CA_DataWrite on the AVCT_REJ path and logs `len` instead of `p_buf->len`.
- system/stack/bnep/bnep_main.cc:bnep_congestion_ind - in the loop that drains xmit_q once congestion clears, saves `len` from the dequeued p_buf before L2CA_DataWrite and logs the local.
- system/stack/bnep/bnep_utils.cc:bnepu_check_send_packet - in the non-congested branch, saves `len` before L2CA_DataWrite and logs the local.
- system/stack/hid/hidd_conn.cc:hidd_check_config_done - saves `len = hd_cb.pending_data->len` before L2CA_DataWrite(p_hcon->intr_cid, hd_cb.pending_data) and logs the local. The new block is irregularly indented but the logic is correct.
- system/stack/rfcomm/rfc_ts_frames.cc:rfc_send_buf_uih - in the branch for DLCIs other than RFCOMM_MX_DLCI, saves `len` before L2CA_DataWrite and logs the local.
- system/stack/rfcomm/rfc_utils.cc:rfc_check_send_cmd - in the cmd_q drain loop, saves `len = p->len` before L2CA_DataWrite and logs the local.
- system/stack/sdp/sdp_discovery.cc:process_service_attr_rsp - replaces `p_msg->len` in the log with `p - p_start`, the same value assigned to p_msg->len just before the call.
- system/stack/sdp/sdp_server.cc:process_service_search and process_service_attr_req - replace `p_buf->len` in the log with `p_rsp - p_rsp_start`, the value assigned to p_buf->len just before the call.
- L2CA_DataWrite itself and the buffer ownership model are not changed. The fix only removes the read of the buffer after the call at the logging sites.
Completeness
- Nine sites across eight files are changed in the same way. The android-security-15.0.0_r17 code context shows the fixed form in bnep_congestion_ind, bnepu_check_send_packet, hidd_check_config_done, rfc_send_buf_uih, rfc_check_send_cmd, process_service_attr_rsp and process_service_search. The avct_lcb_msg_ind excerpt does not include the patched lines, and process_service_attr_req is not shown.
- The fix only touches the log statements: it removes the read of `->len` after the call. In the diff hunks, no other buffer field is read after the call at these sites.
- The commit title says 'more' memory-unsafe logging, which implies at least one related earlier commit covering other sites. That commit is not in the material, so this diff alone cannot show whether every L2CA_DataWrite failure-path log in the stack is covered.
Behavior changes
- None functionally. The warnings log the same length value, now taken from a local or from the pointer difference that produced it, instead of from the possibly freed buffer.
Per major
- Android 14: Not affected per the bulletin. At android-security-14.0.0_r29, 4/8 lines of the patched region are present. The material does not show whether an equivalent change exists or the code differs.
- Android 15: Same fix, applied via cherry-pick to android-security-15.0.0_r5 (Change-Id I6289907e86786eb2e10a163f7fb5d2557eab00bc). At android-security-15.0.0_r17 the resolver finds 7/8 lines of the patched region, and the visible context shows the fixed form at the sites it covers.
- Android 16: Not affected per the bulletin. At android-security-16.0.0_r8, 4/8 lines of the patched region are present. The material includes no Android 16 code that explains the difference.
- Android 17: Not affected per the bulletin. At android-security-17.0.0_r1, 4/8 lines of the patched region are present. The material includes no Android 17 code that explains the difference.
Unknowns
- The material does not show the L2CA_DataWrite implementation. That it can free the buffer on failure comes only from the commit message.
- The related commit implied by the title 'Fix more memory-unsafe logging', and which of the nine bug IDs maps to which site, are not in the material.
- Whether Android 14, 16 and 17 contain an equivalent change, refactored code, or an unpatched form cannot be determined from the 4/8 line match alone.
- Which patched line is missing from the 7/8 match at android-security-15.0.0_r17, and the r17 state of avct_lcb_msg_ind and process_service_attr_req, are not shown.