Re: [PATCH bpf-next v4 0/3] HID: bpf: Fix hid_bpf_get_data() range check

[Benjamin Tissoires]

On Tue, 23 Jun 2026 06:23:12 +0000, Yiyang Chen wrote:
> hid_bpf_get_data() exposes a pointer into the HID-BPF context data when
> the caller-provided offset and size fit inside ctx->allocated_size.
> The helper currently checks that range with:
> 
>   rdwr_buf_size + offset > ctx->allocated_size
> 
> Since both operands are unsigned, a very large size can wrap the sum and
> make an out-of-range request look valid.
> 
> [...]

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git (for-7.2/upstream-fixes), thanks!

[1/3] HID: bpf: Fix hid_bpf_get_data() range check
      https://git.kernel.org/hid/hid/c/2d044049421d
[2/3] selftests/hid: Load only requested struct_ops maps
      https://git.kernel.org/hid/hid/c/5aad55011a37
[3/3] selftests/hid: Cover hid_bpf_get_data() size overflow
      https://git.kernel.org/hid/hid/c/eebbef7c468a

Cheers,
-- 
Benjamin Tissoires <bentiss@xxxxxxxxxx>