Re: [PATCH] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

Re: [PATCH] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[Shen Yongchao]

Hi Greg,

> Why min_t()?  Was this generated by a LLM?  If so, you have to
> document that as well.

Yes, the patch was drafted with AI assistance; the vulnerability
analysis, source-level verification, and reproducer work were
done manually.  I should have disclosed that -- thank you for
asking.

And you are right about min_t(), it is unnecessarily obscure
here.  v2 below uses a plain if instead.

Regards,
Shen Yongchao

[PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[Shen Yongchao]

The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
count from the first payload byte of the ISH firmware response
(max 255) and stores it in hid_dev_count without any bounds
check.  This value propagates to num_hid_devices and is used to
index five fixed-size arrays in struct ishtp_cl_data
(MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],
hid_sensor_hubs[], hid_descr[], and hid_descr_size[].

If the firmware reports more than 32 devices, hid_ishtp_cl_init()
writes past all five arrays, corrupting subsequent struct fields
(including work_struct members with embedded function pointers)
and potentially adjacent heap objects.

Clamp hid_dev_count to MAX_HID_DEVICES at the single point where
it enters the driver (process_recv, ENUM_DEVICES branch), which
covers both the probe and the reset paths.

This is a data-validation hardening fix: the ISH firmware is
within the platform trust boundary (loaded via CSME).

This patch was drafted with AI assistance; the vulnerability
analysis and source-level verification were done manually.

Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@vger.kernel.org
---
 drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 6d64008..XXXXXXX 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -123,6 +123,8 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 				break;
 			}
 			client_data->hid_dev_count = (unsigned int)*payload;
+			if (client_data->hid_dev_count > MAX_HID_DEVICES)
+				client_data->hid_dev_count = MAX_HID_DEVICES;
 			if (!client_data->hid_devices)
 				client_data->hid_devices = devm_kcalloc(
 						cl_data_to_dev(client_data),

Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[Greg Kroah-Hartman]

On Thu, Jul 30, 2026 at 08:25:08PM +0800, Shen Yongchao wrote:
> The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
> count from the first payload byte of the ISH firmware response
> (max 255) and stores it in hid_dev_count without any bounds
> check.  This value propagates to num_hid_devices and is used to
> index five fixed-size arrays in struct ishtp_cl_data
> (MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],
> hid_sensor_hubs[], hid_descr[], and hid_descr_size[].
> 
> If the firmware reports more than 32 devices, hid_ishtp_cl_init()
> writes past all five arrays, corrupting subsequent struct fields
> (including work_struct members with embedded function pointers)
> and potentially adjacent heap objects.
> 
> Clamp hid_dev_count to MAX_HID_DEVICES at the single point where
> it enters the driver (process_recv, ENUM_DEVICES branch), which
> covers both the probe and the reset paths.
> 
> This is a data-validation hardening fix: the ISH firmware is
> within the platform trust boundary (loaded via CSME).
> 
> This patch was drafted with AI assistance; the vulnerability
> analysis and source-level verification were done manually.

Great, please use the Assisted-by: tag as the documentation requries :)

thanks,

greg k-h

Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[srinivas pandruvada]

+Lixu

On Thu, 2026-07-30 at 20:25 +0800, Shen Yongchao wrote:
> The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
> count from the first payload byte of the ISH firmware response
> (max 255) and stores it in hid_dev_count without any bounds
> check.  This value propagates to num_hid_devices and is used to
> index five fixed-size arrays in struct ishtp_cl_data
> (MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],
> hid_sensor_hubs[], hid_descr[], and hid_descr_size[].
> 
> If the firmware reports more than 32 devices, hid_ishtp_cl_init()
> writes past all five arrays, corrupting subsequent struct fields
> (including work_struct members with embedded function pointers)
> and potentially adjacent heap objects.
> 
> Clamp hid_dev_count to MAX_HID_DEVICES at the single point where
> it enters the driver (process_recv, ENUM_DEVICES branch), which
> covers both the probe and the reset paths.
> 
> This is a data-validation hardening fix: the ISH firmware is
> within the platform trust boundary (loaded via CSME).
> 
> This patch was drafted with AI assistance; the vulnerability
> analysis and source-level verification were done manually.
> 
> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
> Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
> Cc: stable@vger.kernel.org

Missing

Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]


Thanks,
Srinivas

> ---
>  drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> index 6d64008..XXXXXXX 100644
> --- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> +++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> @@ -123,6 +123,8 @@ static void process_recv(struct ishtp_cl
> *hid_ishtp_cl, void *recv_buf,
>  				break;
>  			}
>  			client_data->hid_dev_count = (unsigned
> int)*payload;
> +			if (client_data->hid_dev_count >
> MAX_HID_DEVICES)
> +				client_data->hid_dev_count =
> MAX_HID_DEVICES;
>  			if (!client_data->hid_devices)
>  				client_data->hid_devices =
> devm_kcalloc(
>  						cl_data_to_dev(clien
> t_data),

Re: Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[grayhat]

Thanks, +Lixu noted.

Corrected tag block:

This patch was drafted with AI assistance.

Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Assisted-by: Hermes:kimi-k3

Let me know if you want it resent as a proper [PATCH v2].

Thanks,
Shen Yongchao



>+Lixu



>



>On Thu, 2026-07-30 at 20:25 +0800, Shen Yongchao wrote:



>> The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device



>> count from the first payload byte of the ISH firmware response



>> (max 255) and stores it in hid_dev_count without any bounds



>> check.  This value propagates to num_hid_devices and is used to



>> index five fixed-size arrays in struct ishtp_cl_data



>> (MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],



>> hid_sensor_hubs[], hid_descr[], and hid_descr_size[].



>> 



>> If the firmware reports more than 32 devices, hid_ishtp_cl_init()



>> writes past all five arrays, corrupting subsequent struct fields



>> (including work_struct members with embedded function pointers)



>> and potentially adjacent heap objects.



>> 



>> Clamp hid_dev_count to MAX_HID_DEVICES at the single point where



>> it enters the driver (process_recv, ENUM_DEVICES branch), which



>> covers both the probe and the reset paths.



>> 



>> This is a data-validation hardening fix: the ISH firmware is



>> within the platform trust boundary (loaded via CSME).



>> 



>> This patch was drafted with AI assistance; the vulnerability



>> analysis and source-level verification were done manually.



>> 



>> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>



>> Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")



>> Cc: stable@vger.kernel.org



>



>Missing



>



>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]



>



>



>Thanks,



>Srinivas



>



>> ---



>>  drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 ++



>>  1 file changed, 2 insertions(+)



>> 



>> diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> b/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> index 6d64008..XXXXXXX 100644



>> --- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> +++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c



>> @@ -123,6 +123,8 @@ static void process_recv(struct ishtp_cl



>> *hid_ishtp_cl, void *recv_buf,



>>  				break;



>>  			}



>>  			client_data->hid_dev_count = (unsigned



>> int)*payload;



>> +			if (client_data->hid_dev_count >



>> MAX_HID_DEVICES)



>> +				client_data->hid_dev_count =



>> MAX_HID_DEVICES;



>>  			if (!client_data->hid_devices)



>>  				client_data->hid_devices =



>> devm_kcalloc(



>>  						cl_data_to_dev(clien



>> t_data),

Re: Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[gregkh]

On Fri, Jul 31, 2026 at 09:46:43AM +0800, grayhat@foxmail.com wrote:
> Thanks, +Lixu noted.
> 
> Corrected tag block:
> 
> This patch was drafted with AI assistance.
> 
> Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
> Assisted-by: Hermes:kimi-k3
> 
> Let me know if you want it resent as a proper [PATCH v2].

That would be v3 :)

RE: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[Zhang, Lixu]

>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
>Sent: Friday, July 31, 2026 2:11 AM
>To: Shen Yongchao <grayhat@foxmail.com>; Greg Kroah-Hartman
><gregkh@linuxfoundation.org>; Zhang, Lixu <lixu.zhang@intel.com>
>Cc: Jiri Kosina <jikos@kernel.org>; Benjamin Tissoires <bentiss@kernel.org>;
>linux-input@vger.kernel.org; linux-kernel@vger.kernel.org
>Subject: Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to
>MAX_HID_DEVICES
>
>+Lixu

Code-wise, the changes look good to me.

Tested-by: Zhang Lixu <lixu.zhang@intel.com>

Thanks,
Lixu

>
>On Thu, 2026-07-30 at 20:25 +0800, Shen Yongchao wrote:
>> The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
>count
>> from the first payload byte of the ISH firmware response (max 255) and
>> stores it in hid_dev_count without any bounds check.  This value
>> propagates to num_hid_devices and is used to index five fixed-size
>> arrays in struct ishtp_cl_data (MAX_HID_DEVICES = 32): report_descr[],
>> report_descr_size[], hid_sensor_hubs[], hid_descr[], and
>> hid_descr_size[].
>>
>> If the firmware reports more than 32 devices, hid_ishtp_cl_init()
>> writes past all five arrays, corrupting subsequent struct fields
>> (including work_struct members with embedded function pointers) and
>> potentially adjacent heap objects.
>>
>> Clamp hid_dev_count to MAX_HID_DEVICES at the single point where it
>> enters the driver (process_recv, ENUM_DEVICES branch), which covers
>> both the probe and the reset paths.
>>
>> This is a data-validation hardening fix: the ISH firmware is within
>> the platform trust boundary (loaded via CSME).
>>
>> This patch was drafted with AI assistance; the vulnerability analysis
>> and source-level verification were done manually.
>>
>> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
>> Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
>> Cc: stable@vger.kernel.org
>
>Missing
>
>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
>
>
>Thanks,
>Srinivas
>

Re: Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[srinivas pandruvada]

On Fri, 2026-07-31 at 09:46 +0800, grayhat@foxmail.com wrote:
> Thanks, +Lixu noted.
> 
> Corrected tag block:
> 
> This patch was drafted with AI assistance.
> 
> Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
> Assisted-by: Hermes:kimi-k3
> 
> Let me know if you want it resent as a proper [PATCH v2].
> 
Yes with new version. Add Tested by tag also from Lixu.

Also some suggestions:
- Avoid top posting like this, you can add this part just after your
existing tags.
- If the patch is long you can trim

- I think you use outlook to reply, there are some suggestions of email
clients and other suggestions.
https://docs.kernel.org/process/email-clients.html

Also some other links:
https://people.kernel.org/tglx/notes-about-netiquette
https://subspace.kernel.org/etiquette.html



Thanks,
Srinivas

> Thanks,
> Shen Yongchao
> 
> 
> 
> > +Lixu
> 
> 
> 
> > 
> 
> 
> 
> > On Thu, 2026-07-30 at 20:25 +0800, Shen Yongchao wrote:
> 
> 
> 
> > > The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
> 
> 
> 
> > > count from the first payload byte of the ISH firmware response
> 
> 
> 
> > > (max 255) and stores it in hid_dev_count without any bounds
> 
> 
> 
> > > check.  This value propagates to num_hid_devices and is used to
> 
> 
> 
> > > index five fixed-size arrays in struct ishtp_cl_data
> 
> 
> 
> > > (MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],
> 
> 
> 
> > > hid_sensor_hubs[], hid_descr[], and hid_descr_size[].
> 
> 
> 
> > > 
> 
> 
> 
> > > If the firmware reports more than 32 devices, hid_ishtp_cl_init()
> 
> 
> 
> > > writes past all five arrays, corrupting subsequent struct fields
> 
> 
> 
> > > (including work_struct members with embedded function pointers)
> 
> 
> 
> > > and potentially adjacent heap objects.
> 
> 
> 
> > > 
> 
> 
> 
> > > Clamp hid_dev_count to MAX_HID_DEVICES at the single point where
> 
> 
> 
> > > it enters the driver (process_recv, ENUM_DEVICES branch), which
> 
> 
> 
> > > covers both the probe and the reset paths.
> 
> 
> 
> > > 
> 
> 
> 
> > > This is a data-validation hardening fix: the ISH firmware is
> 
> 
> 
> > > within the platform trust boundary (loaded via CSME).
> 
> 
> 
> > > 
> 
> 
> 
> > > This patch was drafted with AI assistance; the vulnerability
> 
> 
> 
> > > analysis and source-level verification were done manually.
> 
> 
> 
> > > 
> 
> 
> 
> > > Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
> 
> 
> 
> > > Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
> 
> 
> 
> > > Cc: stable@vger.kernel.org
> 
> 
> 
> > 
> 
> 
> 
> > Missing
> 
> 
> 
> > 
> 
> 
> 
> > Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
> 
> 
> 
> > 
> 
> 
> 
> > 
> 
> 
> 
> > Thanks,
> 
> 
> 
> > Srinivas
> 
> 
> 
> > 
> 
> 
> 
> > > ---
> 
> 
> 
> > >  drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 ++
> 
> 
> 
> > >  1 file changed, 2 insertions(+)
> 
> 
> 
> > > 
> 
> 
> 
> > > diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> 
> 
> 
> > > b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> 
> 
> 
> > > index 6d64008..XXXXXXX 100644
> 
> 
> 
> > > --- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> 
> 
> 
> > > +++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
> 
> 
> 
> > > @@ -123,6 +123,8 @@ static void process_recv(struct ishtp_cl
> 
> 
> 
> > > *hid_ishtp_cl, void *recv_buf,
> 
> 
> 
> > >  				break;
> 
> 
> 
> > >  			}
> 
> 
> 
> > >  			client_data->hid_dev_count = (unsigned
> 
> 
> 
> > > int)*payload;
> 
> 
> 
> > > +			if (client_data->hid_dev_count >
> 
> 
> 
> > > MAX_HID_DEVICES)
> 
> 
> 
> > > +				client_data->hid_dev_count =
> 
> 
> 
> > > MAX_HID_DEVICES;
> 
> 
> 
> > >  			if (!client_data->hid_devices)
> 
> 
> 
> > >  				client_data->hid_devices =
> 
> 
> 
> > > devm_kcalloc(
> 
> 
> 
> > >  						cl_data_to_dev(c
> > > lien
> 
> 
> 
> > > t_data),
> 

Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[grayhat]

>On Fri, 2026-07-31 at 09:46 +0800, grayhat@foxmail.com wrote:
>> Let me know if you want it resent as a proper [PATCH v2].


>Yes with new version. Add Tested by tag also from Lixu.


>Also some suggestions:



>- Avoid top posting like this, you can add this part just after your



>existing tags.



>- If the patch is long you can trim


>- I think you use outlook to reply, there are some suggestions of email



>clients and other suggestions.



>https://docs.kernel.org/process/email-clients.html


>Also some other links:



>https://people.kernel.org/tglx/notes-about-netiquette



>https://subspace.kernel.org/etiquette.html


>Thanks,



>Srinivas

Thanks for your review.
Patch v3 has been posted, including the Tested-by tag from Lixu, and
the email quoting format has been fixed following your recommendations.

Shen Yongchao