Yiyang Chen eebbef7c46 selftests/hid: Cover hid_bpf_get_data() size overflow ... Add a HID-BPF regression check for hid_bpf_get_data() requests whose size would overflow when added to the offset. The new rdesc fixup callback asks for offset 2 and size ~0ULL, then records whether the helper returns NULL. A vulnerable kernel returns a non-NULL pointer because the runtime check wraps the addition. A fixed kernel rejects the request. The callback records the helper result without dereferencing any returned pointer. The callback reports the helper result through BSS and returns 0 intentionally. hid_rdesc_fixup return values are consumed as report descriptor fixup results, so a positive test-result value would be interpreted as a replacement report descriptor size. Also add KHDR_INCLUDES to the HID selftest build so hid_bpf.c sees the current kernel UAPI HID definitions on systems whose installed headers do not provide enum hid_report_type. Fixes: 658ee5a64f ("HID: bpf: allocate data memory for device_event BPF programs") Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>		2026-07-01 09:55:36 +02:00
..
hid_bpf_helpers.h	selftests/hid: fix compilation when bpf_wq and hid_device are not exported	2026-03-16 16:21:06 +01:00
hid.c	selftests/hid: Cover hid_bpf_get_data() size overflow	2026-07-01 09:55:36 +02:00