Yiyang Chen 2d04404942 HID: bpf: Fix hid_bpf_get_data() range check ... hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size. Fixes: 658ee5a64f ("HID: bpf: allocate data memory for device_event BPF programs") Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>		2026-07-01 09:55:35 +02:00
..
progs	HID: bpf: Add Huion Inspiroy Frego M button quirk	2026-05-21 17:31:14 +02:00
hid_bpf_dispatch.c	HID: bpf: Fix hid_bpf_get_data() range check	2026-07-01 09:55:35 +02:00
hid_bpf_dispatch.h
hid_bpf_struct_ops.c
Kconfig
Makefile