Re: [PATCH v2] hwmon: valid the data size before reading the sensor data
Guenter Roeck <[email protected]>
| Newsgroups | org.kernel.vger.linux-hwmon,org.kernel.vger.linux-kernel,org.kernel.vger.linux-usb |
|---|---|
| Message-ID | <[email protected]> |
On 8/22/26 00:45, Edward Adam Davis wrote:
> The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
> fails to handle cases where the sensor data length is too small when reading
> the data, resulting in [1] during the read process.
>
> Add a data size check, if the size is less than that required for the
> specific data item to be read, abort the sensor data read operation.
>
> [1]
> BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
> Read of size 2 at addr ffff888108aba257 by task swapper/1/0
> Call Trace:
> get_unaligned_be16 include/linux/unaligned.h:48 [inline]
> aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
> aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
> __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
> hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
> __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
> usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
>
> Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
> Tested-by: [email protected]
> Signed-off-by: Edward Adam Davis <[email protected]>
> ---
> v1 -> v2: change to check the data item and update comments
Please stop sending me AI generated patches. Whatever model you are using
has no clue what it is doing.
Guenter