[PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko

[PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko

[Benjamin Tissoires]

Sashiko detected an existing issue in hid_bpf_hw_request:
if the transport layer returns an error code, hid_bpf_hw_request
returns success, which can confuse the caller.

Add the actual fix and a selftest to ensure this gets properly passed
around.

Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
Benjamin Tissoires (2):
      HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
      selftest/hid: add test for negative return codes for hid_bpf_hw_request

 drivers/hid/bpf/hid_bpf_dispatch.c    |  2 +-
 tools/testing/selftests/hid/hid_bpf.c | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
---
base-commit: b6f69097c8271cca30314fd6e4c802f90737bfcc
change-id: 20260915-wip-bpf-signed_size-83a5a507aac8

Best regards,
--  
Benjamin Tissoires <bentiss@kernel.org>

[PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

[Benjamin Tissoires]

As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative
error code.

Link: https://lore.kernel.org/all/20260904130354.A79471F00A3D@smtp.kernel.org/
Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
 drivers/hid/bpf/hid_bpf_dispatch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index b1de1dd0f21d..ece2c7c45ea6 100644
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -453,7 +453,7 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,
 					      (u64)(long)ctx,
 					      true); /* prevent infinite recursions */
 
-	if (ret > size)
+	if (ret > (ssize_t)size)
 		ret = size;
 	if (ret > 0)
 		memcpy(buf, dma_data, ret);

-- 
2.55.0

[PATCH 2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request

[Benjamin Tissoires]

If the transport driver returns an error, we should ensure we actually
get the error, not a success value.

Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
 tools/testing/selftests/hid/hid_bpf.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/hid/hid_bpf.c b/tools/testing/selftests/hid/hid_bpf.c
index 32d81ba15a25..8c41ebfb85e4 100644
--- a/tools/testing/selftests/hid/hid_bpf.c
+++ b/tools/testing/selftests/hid/hid_bpf.c
@@ -546,6 +546,37 @@ TEST_F(hid_bpf, test_hid_user_raw_request_call)
 	ASSERT_EQ(args.data[1], 2);
 }
 
+/*
+ * Call hid_hw_raw_request against the given uhid device,
+ * check that the program is called and does the expected.
+ */
+TEST_F(hid_bpf, test_hid_user_raw_request_call_eio)
+{
+	struct hid_hw_request_syscall_args args = {
+		.retval = -1,
+		.type = HID_FEATURE_REPORT,
+		.request_type = HID_REQ_GET_PROTOCOL,
+		.size = MAX_BUF_SIZE,
+	};
+	DECLARE_LIBBPF_OPTS(bpf_test_run_opts, tattrs,
+			    .ctx_in = &args,
+			    .ctx_size_in = sizeof(args),
+	);
+	int err, prog_fd;
+
+	LOAD_BPF;
+
+	args.hid = self->hid.hid_id;
+	args.data[0] = 1; /* report ID */
+
+	prog_fd = bpf_program__fd(self->skel->progs.hid_user_raw_request);
+
+	err = bpf_prog_test_run_opts(prog_fd, &tattrs);
+	ASSERT_OK(err) TH_LOG("error while calling bpf_prog_test_run_opts");
+
+	ASSERT_EQ(args.retval, -EIO);
+}
+
 /*
  * Call hid_hw_raw_request against the given uhid device,
  * check that the program is called and prevents the

-- 
2.55.0

Re: [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

[Jiri Kosina]

On Tue, 15 Sep 2026, Benjamin Tissoires wrote:

> As reported by Sashiko:
> If a transport driver encounters a hardware error and returns a negative
> error code such as -EPIPE, ret is implicitly promoted to size_t when
> compared against size. This causes the negative error code to evaluate
> as a large positive number, making the (ret > size) condition true.
> 
> This silently converts the hardware error into a success return value
> and copies the unmodified buffer back, which could leave BPF programs
> operating on uninitialized or stale data.
> 
> Fix this by casting size into ssize_t to return the actual negative
> error code.
> 
> Link: https://lore.kernel.org/all/20260904130354.A79471F00A3D@smtp.kernel.org/
> Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request")
> Cc: stable@vger.kernel.org
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

Acked-by: Jiri Kosina <jkosina@suse.com>

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH 2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request

[Jiri Kosina]

On Tue, 15 Sep 2026, Benjamin Tissoires wrote:

> If the transport driver returns an error, we should ensure we actually
> get the error, not a success value.
> 
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

Acked-by: Jiri Kosina <jkosina@suse.com>

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko

[Benjamin Tissoires]

On Tue, 15 Sep 2026 17:46:56 +0200, Benjamin Tissoires wrote:
> Sashiko detected an existing issue in hid_bpf_hw_request:
> if the transport layer returns an error code, hid_bpf_hw_request
> returns success, which can confuse the caller.
> 
> Add the actual fix and a selftest to ensure this gets properly passed
> around.
> 
> [...]

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git (for-7.3/upstream-fixes), thanks!

[1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
      https://git.kernel.org/hid/hid/c/3afefbfe55c2
[2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request
      https://git.kernel.org/hid/hid/c/3f35b678a1d6

Cheers,
-- 
Benjamin Tissoires <bentiss@kernel.org>