Files
linux-stable-mirror/drivers/hid
Benjamin Tissoires d6efaa50af HID: bpf: prevent buffer overflow in hid_hw_request
commit 2b658c1c44 upstream.

right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.

Fixes: 8bd0488b5e ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests")
Cc: stable@vger.kernel.org
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-25 11:08:46 +01:00
..
2026-03-04 07:21:39 -05:00
2025-09-04 15:31:53 +02:00