1 files changed, 10 insertions, 5 deletions

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0c699cdc3696..d38ab1527006 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -225,17 +225,22 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 
 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 {
-        unsigned char buf[32], hdr;
-        int rsize;
+        unsigned char hdr;
+        u8 *buf;
+        int rsize, ret;
 
-        rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
-        if (rsize > sizeof(buf))
+        buf = hid_alloc_report_buf(report, GFP_ATOMIC);
+        if (!buf)
                 return -EIO;
 
         hid_output_report(report, buf);
         hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 
-        return hidp_send_intr_message(session, hdr, buf, rsize);
+        rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
+        ret = hidp_send_intr_message(session, hdr, buf, rsize);
+
+        kfree(buf);
+        return ret;
 }
 
 static int hidp_get_raw_report(struct hid_device *hid,