On Tue, 15 Sep 2026, Benjamin Tissoires wrote: > As reported by Sashiko: > If a transport driver encounters a hardware error and returns a negative > error code such as -EPIPE, ret is implicitly promoted to size_t when > compared against size. This causes the negative error code to evaluate > as a large positive number, making the (ret > size) condition true. > > This silently converts the hardware error into a success return value > and copies the unmodified buffer back, which could leave BPF programs > operating on uninitialized or stale data. > > Fix this by casting size into ssize_t to return the actual negative > error code. > > Link: https://lore.kernel.org/all/[email protected]/ > Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request") > Cc: [email protected] > Signed-off-by: Benjamin Tissoires <[email protected]>
Acked-by: Jiri Kosina <[email protected]> -- Jiri Kosina SUSE Labs
