* [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
2026-09-15 15:46 [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko Benjamin Tissoires
@ 2026-09-15 15:46 ` Benjamin Tissoires
2026-09-23 16:03 ` Jiri Kosina
2026-09-15 15:46 ` [PATCH 2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request Benjamin Tissoires
2026-09-25 7:46 ` [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko Benjamin Tissoires
2 siblings, 1 reply; 6+ messages in thread
From: Benjamin Tissoires @ 2026-09-15 15:46 UTC (permalink / raw)
To: Jiri Kosina, Shuah Khan
Cc: linux-input, linux-kernel, linux-kselftest, Benjamin Tissoires, stable
As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.
Fix this by casting size into ssize_t to return the actual negative
error code.
Link: https://lore.kernel.org/all/20260904130354.A79471F00A3D@smtp.kernel.org/
Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/bpf/hid_bpf_dispatch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index b1de1dd0f21d..ece2c7c45ea6 100644
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -453,7 +453,7 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,
(u64)(long)ctx,
true); /* prevent infinite recursions */
- if (ret > size)
+ if (ret > (ssize_t)size)
ret = size;
if (ret > 0)
memcpy(buf, dma_data, ret);
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
2026-09-15 15:46 ` [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request Benjamin Tissoires
@ 2026-09-23 16:03 ` Jiri Kosina
0 siblings, 0 replies; 6+ messages in thread
From: Jiri Kosina @ 2026-09-23 16:03 UTC (permalink / raw)
To: Benjamin Tissoires
Cc: Shuah Khan, linux-input, linux-kernel, linux-kselftest, stable
On Tue, 15 Sep 2026, Benjamin Tissoires wrote:
> As reported by Sashiko:
> If a transport driver encounters a hardware error and returns a negative
> error code such as -EPIPE, ret is implicitly promoted to size_t when
> compared against size. This causes the negative error code to evaluate
> as a large positive number, making the (ret > size) condition true.
>
> This silently converts the hardware error into a success return value
> and copies the unmodified buffer back, which could leave BPF programs
> operating on uninitialized or stale data.
>
> Fix this by casting size into ssize_t to return the actual negative
> error code.
>
> Link: https://lore.kernel.org/all/20260904130354.A79471F00A3D@smtp.kernel.org/
> Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request")
> Cc: stable@vger.kernel.org
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Jiri Kosina <jkosina@suse.com>
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request
2026-09-15 15:46 [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko Benjamin Tissoires
2026-09-15 15:46 ` [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request Benjamin Tissoires
@ 2026-09-15 15:46 ` Benjamin Tissoires
2026-09-23 16:03 ` Jiri Kosina
2026-09-25 7:46 ` [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko Benjamin Tissoires
2 siblings, 1 reply; 6+ messages in thread
From: Benjamin Tissoires @ 2026-09-15 15:46 UTC (permalink / raw)
To: Jiri Kosina, Shuah Khan
Cc: linux-input, linux-kernel, linux-kselftest, Benjamin Tissoires
If the transport driver returns an error, we should ensure we actually
get the error, not a success value.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
tools/testing/selftests/hid/hid_bpf.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/tools/testing/selftests/hid/hid_bpf.c b/tools/testing/selftests/hid/hid_bpf.c
index 32d81ba15a25..8c41ebfb85e4 100644
--- a/tools/testing/selftests/hid/hid_bpf.c
+++ b/tools/testing/selftests/hid/hid_bpf.c
@@ -546,6 +546,37 @@ TEST_F(hid_bpf, test_hid_user_raw_request_call)
ASSERT_EQ(args.data[1], 2);
}
+/*
+ * Call hid_hw_raw_request against the given uhid device,
+ * check that the program is called and does the expected.
+ */
+TEST_F(hid_bpf, test_hid_user_raw_request_call_eio)
+{
+ struct hid_hw_request_syscall_args args = {
+ .retval = -1,
+ .type = HID_FEATURE_REPORT,
+ .request_type = HID_REQ_GET_PROTOCOL,
+ .size = MAX_BUF_SIZE,
+ };
+ DECLARE_LIBBPF_OPTS(bpf_test_run_opts, tattrs,
+ .ctx_in = &args,
+ .ctx_size_in = sizeof(args),
+ );
+ int err, prog_fd;
+
+ LOAD_BPF;
+
+ args.hid = self->hid.hid_id;
+ args.data[0] = 1; /* report ID */
+
+ prog_fd = bpf_program__fd(self->skel->progs.hid_user_raw_request);
+
+ err = bpf_prog_test_run_opts(prog_fd, &tattrs);
+ ASSERT_OK(err) TH_LOG("error while calling bpf_prog_test_run_opts");
+
+ ASSERT_EQ(args.retval, -EIO);
+}
+
/*
* Call hid_hw_raw_request against the given uhid device,
* check that the program is called and prevents the
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko
2026-09-15 15:46 [PATCH 0/2] HID: bpf: add one ssize_t check detected by Sashiko Benjamin Tissoires
2026-09-15 15:46 ` [PATCH 1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request Benjamin Tissoires
2026-09-15 15:46 ` [PATCH 2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request Benjamin Tissoires
@ 2026-09-25 7:46 ` Benjamin Tissoires
2 siblings, 0 replies; 6+ messages in thread
From: Benjamin Tissoires @ 2026-09-25 7:46 UTC (permalink / raw)
To: Jiri Kosina, Shuah Khan, Benjamin Tissoires
Cc: linux-input, linux-kernel, linux-kselftest, stable
On Tue, 15 Sep 2026 17:46:56 +0200, Benjamin Tissoires wrote:
> Sashiko detected an existing issue in hid_bpf_hw_request:
> if the transport layer returns an error code, hid_bpf_hw_request
> returns success, which can confuse the caller.
>
> Add the actual fix and a selftest to ensure this gets properly passed
> around.
>
> [...]
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git (for-7.3/upstream-fixes), thanks!
[1/2] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
https://git.kernel.org/hid/hid/c/3afefbfe55c2
[2/2] selftest/hid: add test for negative return codes for hid_bpf_hw_request
https://git.kernel.org/hid/hid/c/3f35b678a1d6
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread