From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-210.mail.qq.com (out162-62-57-210.mail.qq.com [162.62.57.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66EC718AE3 for ; Sat, 22 Aug 2026 07:01:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.210 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787382108; cv=none; b=MMv8pcKi9C9mpH36DngtFmkU5xBSspEKit4bXpcFwx41LeN9/x5MBypC2KoSaSL7QxU4gG05QFz+Ai7EgPDNHOEntXeFc3Sqq+4TqR/mgAKQZpp7J9PRGmmePev+AR4r5nQRfe6gX5lFEK5BRc7daH85GO8+ZpQym/jpfWE4LiY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787382108; c=relaxed/simple; bh=S5G1MiHZm5UcJInmEEhPkWvdjSoh+Wv2NDT12cYlBDY=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=TJt3PV2d+gcpbv7WHX4nu/JeOfZ2NJCYLq7yHgoPjaTMhqt9bnBTaLqW14e4P7PqpFL/PxA8Pr40tTl+3/VgIepo73gGqqT/PPLxsORvPjoPgdYBKN0vQ9iVGmkKhgo8CvG9uAJYoCLyNXUcRnr/kChLemSm5lipff6+mmUqV2M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=wCXF/WRr; arc=none smtp.client-ip=162.62.57.210 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="wCXF/WRr" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1787382074; bh=4bMBVe9U/xhNIhtj6QXVSLuPd/zqwYJEfu4FIGCBSfw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wCXF/WRruDz9o8jTRV/ZIt6yrE/feXNIBjyOZfE+NU/zztWoS6Ud8hVPWaHPci4CW gqd6qLOopgF4QiM2tb2+JZEVGf35TMx5JWmh6Brb2TOc7kwmfElM83HDXMgU+U7noG NGTDe2eQiyb5VpVS0HU8Omno31WS7njUcKV15E64= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrsza73-0.qq.com (NewEsmtp) with SMTP id 3B4644; Sat, 22 Aug 2026 15:00:03 +0800 X-QQ-mid: xmsmtpt1787382003tpc317elk Message-ID: X-QQ-XMAILINFO: MDbayGdXPuoeZkLB4uyNcxZoQeHsbEeBWKoRE0xzruo3adZjCv88kF+gX3/4HF Q9UoRXqSNLnqOt50Tu0L4JMGM1L/SUdcqT3Z2oDlJBAQnhPAuYeEWbXfWLQ14LaXfpx9P5uWKqOU ZccKbbIJkuwKNqZ578sE89at3iGagKUQHwhkMFdfTlQIW3paqAo4fV4Cou0Vc3NpjB79V37VHyq1 861RcAiYA/CJVxkXBDOp6SxRClTBWbDBxgy2qHcuhh1IQGUjWU4+8n3Jivk7W1tJYVnLfy5Xx7U8 2PO75p+V4u3n4+e0IwI8poe0IKRm5HZdtGv5QjmA6bYYsGSsZYBt9G5Fz0iJt5hNrgoI9IhBPeJa /9OCXopt1ZOT3xh6Ven89ry8CKhHAzcwgKxX0oWKRggmoIv3Hf3oH/6NlX5ED35AGr1+e1rAhYqX MEmaRNERNkFTE0RooXvc1zWgmU+evFsXLdWewi/a1PytKJ0Tn8dZtYJ5m6k15ZpjXcZUyASoBaeQ QM60C7pvlDFT3yLynONDQiZrCDYbQdf0wz4A6fsaPALZOs7XBml4NNawSU7EDj0P84jlcfgWTffJ rlJlUcVqkZjF+GmNE6UQVHZ9SBsOkE9lSdbdIUsqeVlc5V0eoyz9BqHef33N9vy+ttebo1+TJi7V w1qS1PFlNQKW3HD5+iHmr7hwrLeB2Zh3IeSR9fhxlbbubcl+N/KX20rhTfckurDr8OyS0wUYVWoM 3y2p/AOo2cdIrICChtlGeynu5V6uP7e+xWa792hc26BKBv+vQw+gZgxJ7LPT8tFGhuUKHiTIhxoa K00SOiXGUO+Ar9T9Rk3IYAgWUpS/RSKnihFZaXn2pgnzWv7R/0mlEkQfDU2x6+AHM5v0fb2I0R3J lnw5znd4R9LmlNn5VcIOYJnNHMY2klfB0z/1ZEc5nnJWwY8UuxScE3T24kA5Hp99zp+0yofRSZTq 7YJ4wifLdNF0Af8UdBlMehpZppcU8JS2J8J3ZDenDdOaJdf+fK2YsrPQmv8x1N+GbaiTGkZrvKLb gjPGk5yA== X-QQ-XMRINFO: Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg== From: Edward Adam Davis To: syzbot+9ee5f5dc18673d6b2f37@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [hwmon?] KASAN: slab-out-of-bounds Read in aqc_raw_event Date: Sat, 22 Aug 2026 15:00:04 +0800 X-OQ-MSGID: <20260822070003.70841-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a891232.91706f20.16b6e3.02b0.GAE@google.com> References: <6a891232.91706f20.16b6e3.02b0.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c index 1ca70e726298..c4c8e806db95 100644 --- a/drivers/hwmon/aquacomputer_d5next.c +++ b/drivers/hwmon/aquacomputer_d5next.c @@ -1324,6 +1324,75 @@ static const struct hwmon_chip_info aqc_chip_info = { .info = aqc_info, }; +static bool aqc_raw_data_valid(struct aqc_data *priv, int size) +{ + int off; + char *msg; + + if (!priv) + return false; + + off = priv->serial_number_start_offset + SERIAL_PART_OFFSET; + if (off >= size) { + msg = "serial number start offset"; + goto invalid; + } + + off = priv->firmware_version_offset; + if (off >= size) { + msg = "firmware version offset"; + goto invalid; + } + + /* Physical temperature sensor readings data size check*/ + if (priv->num_temp_sensors > 0) { + off = priv->temp_sensor_start_offset + + (priv->num_temp_sensors - 1) * AQC_SENSOR_SIZE; + + if (off >= size) { + msg = "temp sensor start offset"; + goto invalid; + } + } + /* Virtual temperature sensor readings data size check*/ + if (priv->num_virtual_temp_sensors > 0) { + off = priv->virtual_temp_sensor_start_offset + + (priv->num_virtual_temp_sensors - 1) * AQC_SENSOR_SIZE; + + if (off >= size) { + msg = "virtual temp sensor start offset"; + goto invalid; + } + } + /* Fan speed and related readings data size check */ + if (priv->num_fans > 0) { + int fan_off = priv->fan_sensor_offsets[priv->num_fans - 1]; + + off = fan_off + priv->fan_structure->power; + if (off >= size) { + msg = "fan power offset"; + goto invalid; + } + + off = fan_off + priv->fan_structure->voltage; + if (off >= size) { + msg = "fan voltage offset"; + goto invalid; + } + + off = fan_off + priv->fan_structure->curr; + if (off >= size) { + msg = "fan curr offset"; + goto invalid; + } + } + + return true; +invalid: + pr_debug("data size (%d) is less than the %s, %s\n", size, msg, __func__); + return false; +} + static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size) { int i, j, sensor_value; @@ -1334,6 +1403,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 priv = hid_get_drvdata(hdev); + if (!aqc_raw_data_valid(priv, size)) + return 0; + /* Info provided with every report */ priv->serial_number[0] = get_unaligned_be16(data + priv->serial_number_start_offset); priv->serial_number[1] = get_unaligned_be16(data + priv->serial_number_start_offset +