[PATCH v2 4/4] HID: intel-ish-hid: add full entry bounds check to report_list parsing

[Shen Yongchao]

The report iterator is never checked against the receive buffer
boundary after computing the sub-report length, so a crafted
report_len can advance the iterator past the message and
subsequent iterations read from arbitrary out-of-bounds memory.

Add a check that the full entry (struct report header plus
payload) fits within the message before processing it.  Also
switch the reports_list and list_end sources from the stale
outer-loop payload variable to recv_msg->payload, which always
points to the current message.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <grayhat@xxxxxxxxxxx>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: stable@xxxxxxxxxxxxxxx
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index efe5c5326..0ac7be0c4 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -282,9 +282,9 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 
 		case HOSTIF_PUBLISH_INPUT_REPORT_LIST:
 			report_type = HID_INPUT_REPORT;
-			reports_list = (struct report_list *)payload;
+			reports_list = (struct report_list *)recv_msg->payload;
 			pos = (u8 *)reports_list->reports;
-			list_end = (u8 *)payload + payload_len;
+			list_end = (u8 *)recv_msg->payload + payload_len;
 
 			for (j = 0; j < reports_list->num_of_reports; j++) {
 				if (pos + sizeof(struct report) > list_end)
@@ -300,6 +300,10 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 
 				inner_len = report_len -
 					sizeof(struct hostif_msg_hdr);
+				if (pos + sizeof(struct report) + inner_len >
+						list_end)
+					break;
+
 
 				for (i = 0; i < client_data->num_hid_devices;
 				     ++i)