[PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[Shen Yongchao]

Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace
fake-flex arrays with flex-array members", v6.13), the
HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports
using a struct report * pointer:

	report += sizeof(*report) + payload_len;

Because report is a struct report * (not a char *), the compiler
multiplies the advance by sizeof(struct report) = 8, making the
actual stride (8 + payload_len) * 8 bytes instead of the intended
8 + payload_len bytes.  On v6.13+ a legitimate aggregated list
with num_of_reports >= 2 drives the second iteration far outside
the message buffer.

Replace the struct report * iterator with a byte-granular u8 *pos
so the advance is computed in bytes.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Fixes: 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex arrays with flex-array members")
Cc: stable@vger.kernel.org
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 6d64008f2..ba52e185c 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -74,6 +74,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 	int report_type;
 	struct report_list *reports_list;
 	struct report *report;
+	u8 *pos;
 	size_t report_len;
 	struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 	int curr_hid_dev = client_data->cur_hid_dev;
@@ -280,9 +281,10 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 		case HOSTIF_PUBLISH_INPUT_REPORT_LIST:
 			report_type = HID_INPUT_REPORT;
 			reports_list = (struct report_list *)payload;
-			report = reports_list->reports;
+			pos = (u8 *)reports_list->reports;
 
 			for (j = 0; j < reports_list->num_of_reports; j++) {
+				report = (struct report *)pos;
 				recv_msg = container_of(&report->msg,
 							struct hostif_msg, hdr);
 				report_len = report->size;
@@ -303,7 +305,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 						0);
 					}
 
-				report += sizeof(*report) + payload_len;
+				pos += sizeof(struct report) + payload_len;
 			}
 			break;
 		default:
@@ -956,4 +958,4 @@ MODULE_AUTHOR("Daniel Drubin <daniel.drubin@intel.com>");
  */
 MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
 
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL");
\ No newline at end of file

[PATCH v2 2/4] HID: intel-ish-hid: bound report_list iteration to message size

[Shen Yongchao]

num_of_reports is a u8 (up to 255) taken directly from the
firmware message, never compared against the actual payload size.
If the count exceeds the number of sub-reports the payload can
hold, the loop iterates past the receive buffer.

Compute list_end from the outer message payload and break out of
the loop when the next struct report header would fall outside
the message.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@vger.kernel.org
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index ba52e185c..6609130ce 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -75,6 +75,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 	struct report_list *reports_list;
 	struct report *report;
 	u8 *pos;
+	u8 *list_end;
 	size_t report_len;
 	struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 	int curr_hid_dev = client_data->cur_hid_dev;
@@ -282,8 +283,12 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 			report_type = HID_INPUT_REPORT;
 			reports_list = (struct report_list *)payload;
 			pos = (u8 *)reports_list->reports;
+			list_end = (u8 *)payload + payload_len;
 
 			for (j = 0; j < reports_list->num_of_reports; j++) {
+				if (pos + sizeof(struct report) > list_end)
+					break;
+
 				report = (struct report *)pos;
 				recv_msg = container_of(&report->msg,
 							struct hostif_msg, hdr);

[PATCH v2 3/4] HID: intel-ish-hid: prevent size_t underflow in report_list parsing

[Shen Yongchao]

payload_len is computed as report_len - sizeof(struct
hostif_msg_hdr) where report_len is a firmware-controlled u16
stored in a size_t.  Values 0..5 underflow to ~SIZE_MAX, causing
hid_input_report() to read far past the receive buffer.

Add an explicit check for report_len < sizeof(struct
hostif_msg_hdr) and use a local inner_len variable instead of
overwriting the outer loop's payload_len.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@vger.kernel.org
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 6609130ce..efe5c5326 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -77,6 +77,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 	u8 *pos;
 	u8 *list_end;
 	size_t report_len;
+	size_t inner_len;
 	struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 	int curr_hid_dev = client_data->cur_hid_dev;
 	struct ishtp_hid_data *hid_data = NULL;
@@ -293,8 +294,11 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 				recv_msg = container_of(&report->msg,
 							struct hostif_msg, hdr);
 				report_len = report->size;
-				payload = recv_msg->payload;
-				payload_len = report_len -
+				if (report_len < sizeof(struct hostif_msg_hdr))
+					break;
+
+
+				inner_len = report_len -
 					sizeof(struct hostif_msg_hdr);
 
 				for (i = 0; i < client_data->num_hid_devices;
@@ -306,11 +310,11 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 						client_data->hid_sensor_hubs[
 									i],
 						report_type,
-						payload, payload_len,
+						recv_msg->payload, inner_len,
 						0);
 					}
 
-				pos += sizeof(struct report) + payload_len;
+				pos += sizeof(struct report) + inner_len;
 			}
 			break;
 		default:

[PATCH v2 4/4] HID: intel-ish-hid: add full entry bounds check to report_list parsing

[Shen Yongchao]

The report iterator is never checked against the receive buffer
boundary after computing the sub-report length, so a crafted
report_len can advance the iterator past the message and
subsequent iterations read from arbitrary out-of-bounds memory.

Add a check that the full entry (struct report header plus
payload) fits within the message before processing it.  Also
switch the reports_list and list_end sources from the stale
outer-loop payload variable to recv_msg->payload, which always
points to the current message.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@vger.kernel.org
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index efe5c5326..0ac7be0c4 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -282,9 +282,9 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 
 		case HOSTIF_PUBLISH_INPUT_REPORT_LIST:
 			report_type = HID_INPUT_REPORT;
-			reports_list = (struct report_list *)payload;
+			reports_list = (struct report_list *)recv_msg->payload;
 			pos = (u8 *)reports_list->reports;
-			list_end = (u8 *)payload + payload_len;
+			list_end = (u8 *)recv_msg->payload + payload_len;
 
 			for (j = 0; j < reports_list->num_of_reports; j++) {
 				if (pos + sizeof(struct report) > list_end)
@@ -300,6 +300,10 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 
 				inner_len = report_len -
 					sizeof(struct hostif_msg_hdr);
+				if (pos + sizeof(struct report) + inner_len >
+						list_end)
+					break;
+
 
 				for (i = 0; i < client_data->num_hid_devices;
 				     ++i)

Re: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[srinivas pandruvada]

+Lixu

On Thu, 2026-07-30 at 20:52 +0800, Shen Yongchao wrote:
> Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace
> fake-flex arrays with flex-array members", v6.13), the
> HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports
> using a struct report * pointer:
> 
> 	report += sizeof(*report) + payload_len;
> 
> Because report is a struct report * (not a char *), the compiler
> multiplies the advance by sizeof(struct report) = 8, making the
> actual stride (8 + payload_len) * 8 bytes instead of the intended
> 8 + payload_len bytes.  On v6.13+ a legitimate aggregated list
> with num_of_reports >= 2 drives the second iteration far outside
> the message buffer.
> 
> Replace the struct report * iterator with a byte-granular u8 *pos
> so the advance is computed in bytes.
> 
> 
> Assisted-by: LLM

Need to follow:

https://docs.kernel.org/process/coding-assistants.html

Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]

Lixu,
Please give a test on few devices. Not sure if we have such device.

Thanks,
Srinivas

> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
> Fixes: 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex arrays
> with flex-array members")
> Cc: stable@vger.kernel.org
> ---
> diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> index 6d64008f2..ba52e185c 100644
> --- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> +++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> @@ -74,6 +74,7 @@ static void process_recv(struct ishtp_cl
> *hid_ishtp_cl, void *recv_buf,
>  	int report_type;
>  	struct report_list *reports_list;
>  	struct report *report;
> +	u8 *pos;
>  	size_t report_len;
>  	struct ishtp_cl_data *client_data =
> ishtp_get_client_data(hid_ishtp_cl);
>  	int curr_hid_dev = client_data->cur_hid_dev;
> @@ -280,9 +281,10 @@ static void process_recv(struct ishtp_cl
> *hid_ishtp_cl, void *recv_buf,
>  		case HOSTIF_PUBLISH_INPUT_REPORT_LIST:
>  			report_type = HID_INPUT_REPORT;
>  			reports_list = (struct report_list
> *)payload;
> -			report = reports_list->reports;
> +			pos = (u8 *)reports_list->reports;
>  
>  			for (j = 0; j < reports_list-
> >num_of_reports; j++) {
> +				report = (struct report *)pos;
>  				recv_msg = container_of(&report-
> >msg,
>  							struct
> hostif_msg, hdr);
>  				report_len = report->size;
> @@ -303,7 +305,7 @@ static void process_recv(struct ishtp_cl
> *hid_ishtp_cl, void *recv_buf,
>  						0);
>  					}
>  
> -				report += sizeof(*report) +
> payload_len;
> +				pos += sizeof(struct report) +
> payload_len;
>  			}
>  			break;
>  		default:
> @@ -956,4 +958,4 @@ MODULE_AUTHOR("Daniel Drubin
> <daniel.drubin@intel.com>");
>   */
>  MODULE_AUTHOR("Srinivas Pandruvada
> <srinivas.pandruvada@linux.intel.com>");
>  
> -MODULE_LICENSE("GPL");
> +MODULE_LICENSE("GPL");
> \ No newline at end of file

Re: Re: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[grayhat]

Thanks, +Lixu noted.

Corrected tag:

Assisted-by: Hermes:kimi-k3

(The last hunk of that patch is stray -- please discard it; it
removes the trailing newline after MODULE_LICENSE.)

Let me know if you want it resent as a proper [PATCH v2].

Thanks,
Shen Yongchao
>+Lixu


>



>On Thu, 2026-07-30 at 20:52 +0800, Shen Yongchao wrote:



>> Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace



>> fake-flex arrays with flex-array members", v6.13), the



>> HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports



>> using a struct report * pointer:



>> 



>> 	report += sizeof(*report) + payload_len;



>> 



>> Because report is a struct report * (not a char *), the compiler



>> multiplies the advance by sizeof(struct report) = 8, making the



>> actual stride (8 + payload_len) * 8 bytes instead of the intended



>> 8 + payload_len bytes.  On v6.13+ a legitimate aggregated list



>> with num_of_reports >= 2 drives the second iteration far outside



>> the message buffer.



>> 



>> Replace the struct report * iterator with a byte-granular u8 *pos



>> so the advance is computed in bytes.



>> 



>> 



>> Assisted-by: LLM



>



>Need to follow:



>



>https://docs.kernel.org/process/coding-assistants.html



>



>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]



>



>Lixu,



>Please give a test on few devices. Not sure if we have such device.



>



>Thanks,



>Srinivas



>



>> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>



>> Fixes: 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex arrays



>> with flex-array members")



>> Cc: stable@vger.kernel.org



>> ---



>> diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> b/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> index 6d64008f2..ba52e185c 100644



>> --- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> +++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> @@ -74,6 +74,7 @@ static void process_recv(struct ishtp_cl



>> *hid_ishtp_cl, void *recv_buf,



>>  	int report_type;



>>  	struct report_list *reports_list;



>>  	struct report *report;



>> +	u8 *pos;



>>  	size_t report_len;



>>  	struct ishtp_cl_data *client_data =



>> ishtp_get_client_data(hid_ishtp_cl);



>>  	int curr_hid_dev = client_data->cur_hid_dev;



>> @@ -280,9 +281,10 @@ static void process_recv(struct ishtp_cl



>> *hid_ishtp_cl, void *recv_buf,



>>  		case HOSTIF_PUBLISH_INPUT_REPORT_LIST:



>>  			report_type = HID_INPUT_REPORT;



>>  			reports_list = (struct report_list



>> *)payload;



>> -			report = reports_list->reports;



>> +			pos = (u8 *)reports_list->reports;



>>  



>>  			for (j = 0; j < reports_list-



>> >num_of_reports; j++) {



>> +				report = (struct report *)pos;



>>  				recv_msg = container_of(&report-



>> >msg,



>>  							struct



>> hostif_msg, hdr);



>>  				report_len = report->size;



>> @@ -303,7 +305,7 @@ static void process_recv(struct ishtp_cl



>> *hid_ishtp_cl, void *recv_buf,



>>  						0);



>>  					}



>>  



>> -				report += sizeof(*report) +



>> payload_len;



>> +				pos += sizeof(struct report) +



>> payload_len;



>>  			}



>>  			break;



>>  		default:



>> @@ -956,4 +958,4 @@ MODULE_AUTHOR("Daniel Drubin



>> <daniel.drubin@intel.com>");



>>   */



>>  MODULE_AUTHOR("Srinivas Pandruvada



>> <srinivas.pandruvada@linux.intel.com>");



>>  



>> -MODULE_LICENSE("GPL");



>> +MODULE_LICENSE("GPL");



>> \ No newline at end of file

RE: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[Zhang, Lixu]

>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
>Sent: Friday, July 31, 2026 2:09 AM
>To: Shen Yongchao <grayhat@foxmail.com>; linux-input@vger.kernel.org;
>Zhang, Lixu <lixu.zhang@intel.com>
>Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>; Jiri Kosina
><jikos@kernel.org>; Benjamin Tissoires <bentiss@kernel.org>; linux-
>kernel@vger.kernel.org
>Subject: Re: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer
>arithmetic
>
>+Lixu
>
>On Thu, 2026-07-30 at 20:52 +0800, Shen Yongchao wrote:
>> Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex
>> arrays with flex-array members", v6.13), the
>> HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports
>> using a struct report * pointer:
>>
>> 	report += sizeof(*report) + payload_len;
>>
>> Because report is a struct report * (not a char *), the compiler
>> multiplies the advance by sizeof(struct report) = 8, making the actual
>> stride (8 + payload_len) * 8 bytes instead of the intended
>> 8 + payload_len bytes.  On v6.13+ a legitimate aggregated list with
>> num_of_reports >= 2 drives the second iteration far outside the
>> message buffer.
>>
>> Replace the struct report * iterator with a byte-granular u8 *pos so
>> the advance is computed in bytes.
>>
>>
>> Assisted-by: LLM
>
>Need to follow:
>
>https://docs.kernel.org/process/coding-assistants.html
>
>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
>
>Lixu,
>Please give a test on few devices. Not sure if we have such device.

I checked the firmware side and it does not appear to send
HOSTIF_PUBLISH_INPUT_REPORT_LIST, it batches reports as multiple regular
HOSTIF_PUBLISH_INPUT_REPORT messages in one ISHTP buffer instead.

So I cannot really exercise this specific code path. I only ran some basic sanity
testing on the normal HID report path and did not observe any regression.

Code-wise, the changes look good to me.

Tested-by: Zhang Lixu <lixu.zhang@intel.com>
                                           
Thanks,
Lixu

>
>Thanks,
>Srinivas
>