[PATCH v2 2/4] HID: intel-ish-hid: bound report_list iteration to message size

[Shen Yongchao]

num_of_reports is a u8 (up to 255) taken directly from the
firmware message, never compared against the actual payload size.
If the count exceeds the number of sub-reports the payload can
hold, the loop iterates past the receive buffer.

Compute list_end from the outer message payload and break out of
the loop when the next struct report header would fall outside
the message.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@xxxxxxxxxxx>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@xxxxxxxxxxxxxxx
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index ba52e185c..6609130ce 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -75,6 +75,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 	struct report_list *reports_list;
 	struct report *report;
 	u8 *pos;
+	u8 *list_end;
 	size_t report_len;
 	struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 	int curr_hid_dev = client_data->cur_hid_dev;
@@ -282,8 +283,12 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 			report_type = HID_INPUT_REPORT;
 			reports_list = (struct report_list *)payload;
 			pos = (u8 *)reports_list->reports;
+			list_end = (u8 *)payload + payload_len;
 
 			for (j = 0; j < reports_list->num_of_reports; j++) {
+				if (pos + sizeof(struct report) > list_end)
+					break;
+
 				report = (struct report *)pos;
 				recv_msg = container_of(&report->msg,
 							struct hostif_msg, hdr);