Yiyang Chen 2d04404942 HID: bpf: Fix hid_bpf_get_data() range check ... hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size. Fixes: 658ee5a64f ("HID: bpf: allocate data memory for device_event BPF programs") Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>		2026-07-01 09:55:35 +02:00
..
progs	HID: bpf: Add Huion Inspiroy Frego M button quirk	2026-05-21 17:31:14 +02:00
hid_bpf_dispatch.c	HID: bpf: Fix hid_bpf_get_data() range check	2026-07-01 09:55:35 +02:00
hid_bpf_dispatch.h	HID: bpf: prevent infinite recursions with hid_hw_raw_requests hooks	2024-06-27 11:00:12 +02:00
hid_bpf_struct_ops.c	Revert "HID: bpf: allow write access to quirks field in struct hid_device"	2024-11-25 09:21:47 -08:00
Kconfig	hid: bpf: add BPF_JIT dependency	2024-07-22 16:52:05 +02:00
Makefile	HID: bpf: remove tracing HID-BPF capability	2024-06-14 11:20:20 +02:00