[PATCH] HID: sensor-hub: fix out-of-bounds access in sensor_hub_get_feature()

sensor_hub_get_feature() copies each field value with
memcpy(..., report->field[...]->report_size / 8), a size taken only
from the descriptor and bounded neither to the caller buffer nor to the
field->value[] array.

When report_size exceeds the remaining buffer (e.g. a 64-bit power-state
field into a 4-byte int) the copy overflows the caller's stack on the
first iteration; when report_size > 32 it also reads past field->value[]
(one __s32 per logical value) into slab, leaking bytes to userspace via
callers that expose the buffer (hid-sensor-custom show_value over sysfs).
Reachable from an untrusted USB or Bluetooth HID device with no local
privileges.

Bound the per-iteration copy to min(report_size/8,
(report_count-i)*sizeof(__s32), buffer_size - buffer_index).

Fixes: 5459ada2b3cd ("HID: sensor-hub: Fix packing of result buffer for feature report")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <redacted>
---
 drivers/hid/hid-sensor-hub.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 34f710c465b80a0c46cc207e3d99a07c5767f291..978335db71b09617c87e879911b8e75b6bfdebb8 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c

@@ -270,11 +270,18 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
 	val_ptr = (u8 *)report->field[field_index]->value;
 	for (i = 0; i < report->field[field_index]->report_count; ++i) {
+		int copy = report->field[field_index]->report_size / 8;
+		int src_remaining = (report->field[field_index]->report_count - i) *
+				    sizeof(__s32);
+
 		if (buffer_index >= ret)
 			break;
 
-		memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
-		       report->field[field_index]->report_size / 8);
+		if (copy > src_remaining)
+			copy = src_remaining;
+		if (copy > buffer_size - buffer_index)
+			copy = buffer_size - buffer_index;
+		memcpy(&((u8 *)buffer)[buffer_index], val_ptr, copy);
 		val_ptr += sizeof(__s32);
 		buffer_index += (report->field[field_index]->report_size / 8);
 	}

---
base-commit: bf0a94fb2b59542f9dd6fea4eec67336f1ccfa56
change-id: 20260806-hid-sensor-hub-oob-f316fd015b76

Best regards,
-- 
Shengzhuo Wei [off-list ref]