* [PATCH] hwmon: corsair-psu: fix possible out-of-bounds access on missing string termination
@ 2026-08-05 7:19 Wilken Gottwalt
2026-08-05 14:51 ` Guenter Roeck
0 siblings, 1 reply; 2+ messages in thread
From: Wilken Gottwalt @ 2026-08-05 7:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Guenter Roeck, linux-hwmon
In theory it could be possible that the REPLY_SIZE sized buffers for
holding the vendor and product strings could be end up missing the null
termination (for example by malicious hardware built on purpose)
required by the seq_printf() call. That limits the debugfs printf calls
to a maximum string length of REPLY_SIZE.
Fixes: d115b51e0e567 ("hwmon: add Corsair PSU HID controller driver")
Signed-off-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
---
drivers/hwmon/corsair-psu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c
index ce958cdaef58..3cb0ba592250 100644
--- a/drivers/hwmon/corsair-psu.c
+++ b/drivers/hwmon/corsair-psu.c
@@ -701,7 +701,7 @@ static int vendor_show(struct seq_file *seqf, void *unused)
{
struct corsairpsu_data *priv = seqf->private;
- seq_printf(seqf, "%s\n", priv->vendor);
+ seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->vendor);
return 0;
}
@@ -711,7 +711,7 @@ static int product_show(struct seq_file *seqf, void *unused)
{
struct corsairpsu_data *priv = seqf->private;
- seq_printf(seqf, "%s\n", priv->product);
+ seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->product);
return 0;
}
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] hwmon: corsair-psu: fix possible out-of-bounds access on missing string termination
2026-08-05 7:19 [PATCH] hwmon: corsair-psu: fix possible out-of-bounds access on missing string termination Wilken Gottwalt
@ 2026-08-05 14:51 ` Guenter Roeck
0 siblings, 0 replies; 2+ messages in thread
From: Guenter Roeck @ 2026-08-05 14:51 UTC (permalink / raw)
To: Wilken Gottwalt; +Cc: linux-kernel, linux-hwmon
On Wed, Aug 05, 2026 at 07:19:20AM +0000, Wilken Gottwalt wrote:
> In theory it could be possible that the REPLY_SIZE sized buffers for
> holding the vendor and product strings could be end up missing the null
> termination (for example by malicious hardware built on purpose)
> required by the seq_printf() call. That limits the debugfs printf calls
> to a maximum string length of REPLY_SIZE.
>
> Fixes: d115b51e0e567 ("hwmon: add Corsair PSU HID controller driver")
> Signed-off-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Applied.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-05 14:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-05 7:19 [PATCH] hwmon: corsair-psu: fix possible out-of-bounds access on missing string termination Wilken Gottwalt
2026-08-05 14:51 ` Guenter Roeck
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®