RE: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer arithmetic

>-----Original Message-----
>From: srinivas pandruvada <[email protected]>
>Sent: Friday, July 31, 2026 2:09 AM
>To: Shen Yongchao <[email protected]>; [email protected];
>Zhang, Lixu <[email protected]>
>Cc: Greg Kroah-Hartman <[email protected]>; Jiri Kosina
><[email protected]>; Benjamin Tissoires <[email protected]>; linux-
>[email protected]
>Subject: Re: [PATCH v2 1/4] HID: intel-ish-hid: fix report_list iterator pointer
>arithmetic
>
>+Lixu
>
>On Thu, 2026-07-30 at 20:52 +0800, Shen Yongchao wrote:
>> Since commit 63cafaf47a83 ("HID: ishtp-hid-client: replace fake-flex
>> arrays with flex-array members", v6.13), the
>> HOSTIF_PUBLISH_INPUT_REPORT_LIST handler iterates over sub-reports
>> using a struct report * pointer:
>>
>> 	report += sizeof(*report) + payload_len;
>>
>> Because report is a struct report * (not a char *), the compiler
>> multiplies the advance by sizeof(struct report) = 8, making the actual
>> stride (8 + payload_len) * 8 bytes instead of the intended
>> 8 + payload_len bytes.  On v6.13+ a legitimate aggregated list with
>> num_of_reports >= 2 drives the second iteration far outside the
>> message buffer.
>>
>> Replace the struct report * iterator with a byte-granular u8 *pos so
>> the advance is computed in bytes.
>>
>>
>> Assisted-by: LLM
>
>Need to follow:
>
>https://docs.kernel.org/process/coding-assistants.html
>
>Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
>
>Lixu,
>Please give a test on few devices. Not sure if we have such device.

I checked the firmware side and it does not appear to send
HOSTIF_PUBLISH_INPUT_REPORT_LIST, it batches reports as multiple regular
HOSTIF_PUBLISH_INPUT_REPORT messages in one ISHTP buffer instead.

So I cannot really exercise this specific code path. I only ran some basic sanity
testing on the normal HID report path and did not observe any regression.

Code-wise, the changes look good to me.

Tested-by: Zhang Lixu <[email protected]>
                                           
Thanks,
Lixu

>
>Thanks,
>Srinivas
>