From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00C5F3F23DF for ; Tue, 16 Jun 2026 22:52:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781650361; cv=none; b=BMCa57+V/dSmiFu5hN4V8YlDNhdQXlyj2L1N1X2QV8lAtYJ+oiESP/O68AMaKIe/ItU5Z+I1o72Lj0p4VTNJYeDv0Lrd6OBmjaKygKRpNSA5mtFI08tx469Y8yB7kcGQIHFkmKSJWnysRYuCRWQVZektnDzeEKpQPo+XhZCZD4c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781650361; c=relaxed/simple; bh=yOTU6w139ebGNpr1jYhz4dm0//DwIZIeTHbPxC1bh10=; h=Mime-Version:Content-Type:Date:Message-Id:To:Cc:Subject:From: References:In-Reply-To; b=Z6e53HP5jEmo5Ha6vYTLyCqyJeS8bK1BeNa6IHrpuKwgTWv6zk9vHV0huB1ccVF6Sq2wJGaVqiLQv08J1TgMi7JFVsgq4V24fFFCUWxIicuk8Ot5Fh/XKsk6u+8glrrLj0PhEcLkP7pFunFPj8HruIpL44ZeNmobgjlJY5UBM7M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com; spf=pass smtp.mailfrom=etsalapatis.com; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b=EAE+UA/1; arc=none smtp.client-ip=74.125.82.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b="EAE+UA/1" Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-13986d61b4fso1301222c88.0 for ; Tue, 16 Jun 2026 15:52:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etsalapatis-com.20251104.gappssmtp.com; s=20251104; t=1781650359; x=1782255159; darn=vger.kernel.org; h=in-reply-to:references:from:subject:cc:to:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=3DnWQh/dYS3heDu56hFCU5ip/WEIP0vqTwzgJSaTXBk=; b=EAE+UA/1JuZCPfrxtloIW4YzuebB6PEjS1HOjyvwMadxqJyzDu/Kq8RJKgM5ZkYfrK 7jHMc7QLrLKuk+ex+qQh0DSupIdpqQ9FQT+3GfOikxW/yeJJo1p9Gwj0cT9A5K1n285j xKLR4Am3+1ZB9+/mHyqJIyOjFZZvdjcSfLpQ7N0/ba7g24s0B40I7Rf/K9AvTGMfdAOX 2qsunwapaMeV++1q4LRw1aaLp5Ra6mfZtWzjHTaO8bV3N9H4gJ6s6K5YoyOhIG4pwz+n AkWDXO5bhxaIKQjPsfEL/hNbuXM/+oT7XOvxdFAlH93l1OXk1TJ+ZJnAbxiYazCaUvFi chig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781650359; x=1782255159; h=in-reply-to:references:from:subject:cc:to:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=3DnWQh/dYS3heDu56hFCU5ip/WEIP0vqTwzgJSaTXBk=; b=W7nsSbB5jAehipGtmlS+xI19IT8a5p+VnB9V80cHNGuIgng9nKVIvd3+4H005XLhLU fweNC1SNDnxl514sJpCGhXPpSy0AGtj+C4bsLOB8Y5QGPbdXnAwN4h9PNGSj6HtMX8Bu IXpX/Z97y7neSBXA5iVJaj5Lnqn1Tk1h/YCuIvNuTQIrAV49rtr7xKfmGeTEyj+avUTm 9QaQ4Kn2caVTIoohAGOD/KRsZwZTMa4R3GuMJjq1k+7JCdqdKeM6++rM0pa031wRNUAv rSaJZdppHfu7j+bAFyahw9j+5TI+iLOMmNEF7rp1hrmJf3z7ZYW5Y9sBA7UkUghevNwG DYLw== X-Forwarded-Encrypted: i=1; AFNElJ+3HsizwIwckByKrxN9y/RUgfD9+cYMCJ398Ge9nElhA3HtPc3ydD0M1CBbA+3LHnwH1woE2nW/bu/hwK0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw2/cdG1grbIwDdMJhzdEhAgNzBLoqDtRh4+ygg6zzsagD1lhdL ChFjUdrPAy11YokqYQkMSik4rOYMBGcQNbDby14x01wjPdPMhTBRJI3ic5PyelWY8Lk= X-Gm-Gg: Acq92OHwtbBnR0Bf6M/w1HCt6RZVvj0E8v4GNnX7evhvwKvmy95vyMEVC5QmcoPPedg EemdCsrgVveey/x50Y6RngQ5Be8jMIlLvvmRKjw7WrWKAZVExHQ/PeEfetzh+HFWXvmbLLiZXA8 3kYu3vf03pKi06waraaCiLBLuscMHs+FC8F3khlZy1OKkNcDHra5GgHfyyNYc7xkkY8hZ7+pHHv BoZPtbMMnOp8PkGJykjEPfzTE+4T5h17p9CVYKjAaG329Pp2wTUS+XUDmb6IjCzGUuUV+tlL7vB jszKWJQphSYhtdN2m2aY7zCnytSFEASlpPIyDABcj28ry9jo5MuAthO0RJsatrchJU9T9JthB3r It6bKRexG5x+6zz+ZnELiMuupLCIFcYKpLxyzJU1qIlsE2N8VFcZn9bUEykLEUw8mUrMOZMFMFA ArGRrQ X-Received: by 2002:a05:7022:ef16:b0:136:5c88:d928 with SMTP id a92af1059eb24-1398f6c839bmr483612c88.19.1781650358897; Tue, 16 Jun 2026 15:52:38 -0700 (PDT) Received: from localhost ([2620:10d:c090:600::1a8e]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30bbcb11310sm2725155eec.14.2026.06.16.15.52.37 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 16 Jun 2026 15:52:38 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 16 Jun 2026 18:52:36 -0400 Message-Id: To: "Yiyang Chen" , "Jiri Kosina" , "Benjamin Tissoires" , , Cc: "Shuah Khan" , "Alexei Starovoitov" , "Daniel Borkmann" , "Andrii Nakryiko" , "Martin KaFai Lau" , "Eduard Zingerman" , "Kumar Kartikeya Dwivedi" , "Song Liu" , "Yonghong Song" , "Jiri Olsa" , , Subject: Re: [PATCH bpf-next 1/2] HID: bpf: Fix hid_bpf_get_data() range check From: "Emil Tsalapatis" X-Mailer: aerc 0.21.0-0-g5549850facc2 References: <783681f27625a11ed58f00221be046643232a2fc.1781627122.git.chenyy23@mails.tsinghua.edu.cn> In-Reply-To: <783681f27625a11ed58f00221be046643232a2fc.1781627122.git.chenyy23@mails.tsinghua.edu.cn> On Tue Jun 16, 2026 at 12:35 PM EDT, Yiyang Chen wrote: > hid_bpf_get_data() returns a pointer into the HID-BPF context data when > the caller-provided offset and size fit inside ctx->allocated_size. > > The current check adds rdwr_buf_size and offset before comparing the > result against ctx->allocated_size. Since both values are unsigned, a > very large size can wrap the sum below ctx->allocated_size and make the > helper return a pointer even though the requested range is not contained > in the backing buffer. > > Use a non-wrapping range check instead: reject offsets beyond the > allocation, then compare the requested size with the remaining bytes > after the offset. > Reviewed-by: Emil Tsalapatis > Fixes: 4171954f56fb ("HID: bpf/dispatch: regroup kfuncs definitions") > Signed-off-by: Yiyang Chen > --- > drivers/hid/bpf/hid_bpf_dispatch.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf= _dispatch.c > index d0130658091b0..09b45c40d84f0 100644 > --- a/drivers/hid/bpf/hid_bpf_dispatch.c > +++ b/drivers/hid/bpf/hid_bpf_dispatch.c > @@ -299,7 +299,8 @@ hid_bpf_get_data(struct hid_bpf_ctx *ctx, unsigned in= t offset, const size_t rdwr > =20 > ctx_kern =3D container_of(ctx, struct hid_bpf_ctx_kern, ctx); > =20 > - if (rdwr_buf_size + offset > ctx->allocated_size) > + if (offset > ctx->allocated_size || > + rdwr_buf_size > ctx->allocated_size - offset) > return NULL; > =20 > return ctx_kern->data + offset;