hid: avoid 32-bit overflow when computing report size

[ojanerif_amd.com]

Summary

hid_report_size() and hid_report_size_max() compute a field's end bit position as loc.pos + loc.size * loc.count, and hid_get_item() accumulates the same product into loc.pos. loc.size and loc.count are uint32_t taken from the report descriptor with no bound, so a crafted descriptor wraps the 32-bit multiply and the functions return a wrong, usually too small, report size.

It is not exploitable now: hid_get_data() clamps reads to the caller buffer and the input drivers reject reports larger than the endpoint. The size is still wrong, so do the math in 64-bit and saturate at UINT32_MAX. Well-formed descriptors produce the same result.

Test Plan

Build tested on amd64; hid.ko links clean with -Werror. No change for descriptors whose pos + size * count fits in 32 bits.