]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph-client.git/commit
HID: bpf: prevent buffer overflow in hid_hw_request
authorBenjamin Tissoires <bentiss@kernel.org>
Fri, 13 Mar 2026 07:40:25 +0000 (08:40 +0100)
committerBenjamin Tissoires <bentiss@kernel.org>
Mon, 16 Mar 2026 15:21:06 +0000 (16:21 +0100)
commit2b658c1c442ec1cd9eec5ead98d68662c40fe645
tree127b0f24350f5b370ad30a2ddae4a55eb303fdee
parent5d4c6c132ea9a967d48890dd03e6a786c060e968
HID: bpf: prevent buffer overflow in hid_hw_request

right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.

Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests")
Cc: stable@vger.kernel.org
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
drivers/hid/bpf/hid_bpf_dispatch.c