In 'struct hid_parser', the 'collection_stack' pointer field is used
to store a dynamically-allocated array of collection indices. The
size of this allocated array is tracked by 'collection_stack_size'.

Annotate 'collection_stack' with the '__counted_by_ptr' attribute
referencing 'collection_stack_size'. This allows compiler hardening
features (such as KASAN and UBSAN bounds-checking) to detect potential
out-of-bounds accesses to 'collection_stack'.

Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
 include/linux/hid.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/hid.h b/include/linux/hid.h
index 8d17b741638c..403da4cef890 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -790,7 +790,7 @@ struct hid_parser {
 	struct hid_global     global_stack[HID_GLOBAL_STACK_SIZE];
 	unsigned int          global_stack_ptr;
 	struct hid_local      local;
-	unsigned int         *collection_stack;
+	unsigned int         *collection_stack __counted_by_ptr(collection_stack_size);
 	unsigned int          collection_stack_ptr;
 	unsigned int          collection_stack_size;
 	struct hid_device    *device;
-- 
2.55.0.1082.g2b9226bbc0-goog