[PATCH v2 3/4] HID: intel-ish-hid: prevent size_t underflow in report_list parsing

payload_len is computed as report_len - sizeof(struct
hostif_msg_hdr) where report_len is a firmware-controlled u16
stored in a size_t.  Values 0..5 underflow to ~SIZE_MAX, causing
hid_input_report() to read far past the receive buffer.

Add an explicit check for report_len < sizeof(struct
hostif_msg_hdr) and use a local inner_len variable instead of
overwriting the outer loop's payload_len.


Assisted-by: LLM
Signed-off-by: Shen Yongchao <[email protected]>
Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver")
Cc: [email protected]
---
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 6609130ce..efe5c5326 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -77,6 +77,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 	u8 *pos;
 	u8 *list_end;
 	size_t report_len;
+	size_t inner_len;
 	struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 	int curr_hid_dev = client_data->cur_hid_dev;
 	struct ishtp_hid_data *hid_data = NULL;
@@ -293,8 +294,11 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 				recv_msg = container_of(&report->msg,
 							struct hostif_msg, hdr);
 				report_len = report->size;
-				payload = recv_msg->payload;
-				payload_len = report_len -
+				if (report_len < sizeof(struct hostif_msg_hdr))
+					break;
+
+
+				inner_len = report_len -
 					sizeof(struct hostif_msg_hdr);
 
 				for (i = 0; i < client_data->num_hid_devices;
@@ -306,11 +310,11 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 						client_data->hid_sensor_hubs[
 									i],
 						report_type,
-						payload, payload_len,
+						recv_msg->payload, inner_len,
 						0);
 					}
 
-				pos += sizeof(struct report) + payload_len;
+				pos += sizeof(struct report) + inner_len;
 			}
 			break;
 		default: