Re: [PATCH v2] HID: intel-ish-hid: clamp HID device count to MAX_HID_DEVICES

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, Jul 30, 2026 at 08:25:08PM +0800, Shen Yongchao wrote:
> The HOSTIF_DM_ENUM_DEVICES response handler takes the HID device
> count from the first payload byte of the ISH firmware response
> (max 255) and stores it in hid_dev_count without any bounds
> check.  This value propagates to num_hid_devices and is used to
> index five fixed-size arrays in struct ishtp_cl_data
> (MAX_HID_DEVICES = 32): report_descr[], report_descr_size[],
> hid_sensor_hubs[], hid_descr[], and hid_descr_size[].
> 
> If the firmware reports more than 32 devices, hid_ishtp_cl_init()
> writes past all five arrays, corrupting subsequent struct fields
> (including work_struct members with embedded function pointers)
> and potentially adjacent heap objects.
> 
> Clamp hid_dev_count to MAX_HID_DEVICES at the single point where
> it enters the driver (process_recv, ENUM_DEVICES branch), which
> covers both the probe and the reset paths.
> 
> This is a data-validation hardening fix: the ISH firmware is
> within the platform trust boundary (loaded via CSME).
> 
> This patch was drafted with AI assistance; the vulnerability
> analysis and source-level verification were done manually.

Great, please use the Assisted-by: tag as the documentation requries :)

thanks,

greg k-h