From: Mark Amirkan HID-BPF allocates its device-event buffer from the largest report in the device's parsed report descriptor. dispatch_hid_bpf_device_event() then copies the transport-provided report into that buffer before checking its size. An input report larger than the allocated event buffer therefore causes a heap out-of-bounds write when a device-event program is attached. The later check of the BPF program's return value cannot prevent the initial copy. Reject reports that exceed either the transport buffer or the persistent HID-BPF event buffer before clearing or copying the data. With a 64-byte event allocation, a same-file KUnit test produced a one-byte KASAN out-of-bounds write for a 65-byte report in three runs. The 64-byte boundary remained clean. After this change, both cases were clean in three runs and the oversized report returned -EINVAL. The test exercised the production dispatch function but not the complete UHID and BPF attachment path. Fixes: 658ee5a64fcf ("HID: bpf: allocate data memory for device_event BPF programs") Cc: stable@vger.kernel.org Assisted-by: LLM Symbolic Signed-off-by: Mark Amirkan --- drivers/hid/bpf/hid_bpf_dispatch.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c index 536f6d01fd..06ba833eb9 100644 --- a/drivers/hid/bpf/hid_bpf_dispatch.c +++ b/drivers/hid/bpf/hid_bpf_dispatch.c @@ -50,6 +50,9 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type if (!hdev->bpf.device_data) return data; + if (*size > *buf_size || *size > ctx_kern.ctx.allocated_size) + return ERR_PTR(-EINVAL); + memset(ctx_kern.data, 0, hdev->bpf.allocated_data); memcpy(ctx_kern.data, data, *size); --- base-commit: 9cdc7e6dc7a99ad7311ad5e7c145f2b9ce4e24b0 change-id: 20260913-b4-send-hid-bpf-event-bounds-4d0e8170ceb4 Best regards, -- Mark Amirkan