RE: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

[Zhang, Lixu]

>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>
>Sent: Friday, July 31, 2026 2:09 AM
>To: Shen Yongchao <grayhat@xxxxxxxxxxx>; linux-input@xxxxxxxxxxxxxxx;
>Zhang, Lixu <lixu.zhang@xxxxxxxxx>
>Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>; Jiri Kosina
><jikos@xxxxxxxxxx>; Benjamin Tissoires <bentiss@xxxxxxxxxx>; linux-
>kernel@xxxxxxxxxxxxxxx
>Subject: Re: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer
>arithmetic
>
>+Lixu
>
>On Thu, 2026-07-30 at 20:52 +0800, Shen Yongchao wrote:
>> Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex
>> arrays with flex-array members", v6.13), the
>> HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports
>> using a struct report * pointer:
>>
>> 	report += sizeof(*report) + payload_len;
>>
>> Because report is a struct report * (not a char *), the compiler
>> multiplies the advance by sizeof(struct report) = 8, making the actual
>> stride (8 + payload_len) * 8 bytes instead of the intended
>> 8 + payload_len bytes.  On v6.13+ a legitimate aggregated list with
>> num_of_reports >= 2 drives the second iteration far outside the
>> message buffer.
>>
>> Replace the struct report * iterator with a byte-granular u8 *pos so
>> the advance is computed in bytes.
>>
>>
>> Assisted-by: LLM
>
>Need to follow:
>
>https://docs.kernel.org/process/coding-assistants.html
>
>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
>
>Lixu,
>Please give a test on few devices. Not sure if we have such device.

I checked the firmware side and it does not appear to send
HOSTIF_PUBLISH_INPUT_REPORT_LIST, it batches reports as multiple regular
HOSTIF_PUBLISH_INPUT_REPORT messages in one ISHTP buffer instead.

So I cannot really exercise this specific code path. I only ran some basic sanity
testing on the normal HID report path and did not observe any regression.

Code-wise, the changes look good to me.

Tested-by: Zhang Lixu <lixu.zhang@xxxxxxxxx>
                                           
Thanks,
Lixu

>
>Thanks,
>Srinivas
>