From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-173.mail.qq.com (out203-205-221-173.mail.qq.com [203.205.221.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCB0B34FF79 for ; Sat, 22 Aug 2026 08:38:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787387904; cv=none; b=E7dcvNoPRQvOir2HB8AstRZWl/LydvucCuO5aH3WlT4GAd0O5eriWZAb5KjuH6DaazI7tgwP/GcVSodaoaJN2IJzRFzxkutIkU6pB8e6glgG/lmAGiaywRXtOdwyBiTrNUHAmp/ducrUbR+TM/phzPho8/CHy8unljf34W7q8u4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787387904; c=relaxed/simple; bh=3D5eZ+b9FjrwJ/6QZecYdwNnJ8mmgKQjjs7zUOPCq1E=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=sNw3zD5YEoK5MabfkON4jMLdXuKQXMpQrFCZHBeCMhUQDx3/T4l/0wIW2Oe74xMLHuNq99v5el6aV+CrxdN56kKpgoCn5PE4n5TXG4A9LQlCGlAGC0SjSsS+Df3tH43KEh0zqFGPr1TjS1dHeDU+Fddfl7KDEWSPmGR0N7OFFyY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=x6SDzMHJ; arc=none smtp.client-ip=203.205.221.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="x6SDzMHJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1787387897; bh=WhHOUyatZlaVsl6LAnHQ2ddPsxx8AUmDFEurvkJypEI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=x6SDzMHJgefP9S4/+Pd79y2DqYkOeQkQ51vS57e13Epl3hGsvqEx2thc1/aeCI0+T fv1LUfw5TMbLlfnaxrkiAGZ3ytCHKIbQRmZL9xv3Sh3HMkfRV81Ge7eQjuZtBwTkve 1IYxoFfd7UIvlrnWO7zJiFZbzk3GyvUuv9pCIj4Y= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrsza73-0.qq.com (NewEsmtp) with SMTP id 98F9F0AD; Sat, 22 Aug 2026 16:38:15 +0800 X-QQ-mid: xmsmtpt1787387895tauorp6xv Message-ID: X-QQ-XMAILINFO: NT7dO8ok7FP2qFHR5vl+2RsRRPMSi5yTqNxNPi2P1j/q0ob+KuWIiqpOCVTksV CP38DlhwNYNKRLVXAFf3CzsnSqTRMGGT0bieB+cpMKc89OJ3Y6Xbe8Ao930COJJV76ZEB1xIlMhZ rkH6ripmBnB53ns0dy1dQWBsFjqUpUjH1lKWdChFRMKgmzFv9Tznuv1nQpLW2bm6OfHkH8STcUMZ 83NvjOFq65KtKjQ85fbaMH+QbDMOFruDXQj7nokgYk2aCCMXOUQd4m19VWxGiGGE0ELEjZ+x8lO0 qCV45PIVhylyo4E7AClTp5ZL1LNixPFCHYnmMZDm2l6JOaqHZf2FSESOT2Tq1gLxUT8VEcHSZkR3 d8ZAmcp7SmXCTtOCSF7NZO5kM7iIaNMUrh+2gLh4qrICjT4El4C9fkdE/d6yN6XYllLwGO7jtEAx HMy/hE6ITYN5g/AfOeTWDcNOmD2q653VTuBygSOKUDNntTzrNJ8rpLIekWB82icTiAtpymv1RjmE cbgKONF0X25wysH6YKk7rWhkFbCnJoV/UvVLW7i7PQOwcZIFJpeghEGd+6KFCznu897LUv55OpA8 +NLn+59VESZSid6dseGhTK6MHsu/MxcT99/mqAD/urF3E4g9jur5KlAn2AhxudBW6g2IjzOejIjm LJHvvjwPrxfwC0vp2L4FcoA3NDdtK+LKrNoc/VSCsSpjiu7IamYgZdgfERu9nLpeB1ahOxZs2Dlw OUjvk9ajJ4TEw/Wl4UpMIMGkQeXZmQZ43XVZyaEQJfpyeXcKm2RT43IuH8baVYGKuMSggr/48pMT 3IFyb6SQiWr1jaXZqp9VywK4guYavYSJSBfMCe1wYPL2PbHzKzSiZNYyB8cpsRxteUF3IZs3slAc rJrjpe3ckGzg20+Pi03EHGwZNtiQVBn86pPovgFauYdXhRCclKsTZyRX8ORwvDYY7WGM9gobKAr1 AGK0/7190Zus4nYQ0fKgT/bH+KR+u8JTmTGLblbOQ996TN31KWR+Zd0vS0aS6p+g9ZzwGt6744E7 My75Ba+cjY/w07b2hM4JSWiJ4lI2n/V1jU/NLe/qw9OAwReu+5 X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== From: Edward Adam Davis To: syzbot+9ee5f5dc18673d6b2f37@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [hwmon?] KASAN: slab-out-of-bounds Read in aqc_raw_event Date: Sat, 22 Aug 2026 16:38:16 +0800 X-OQ-MSGID: <20260822083815.76348-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a891232.91706f20.16b6e3.02b0.GAE@google.com> References: <6a891232.91706f20.16b6e3.02b0.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c index 1ca70e726298..5621434af768 100644 --- a/drivers/hwmon/aquacomputer_d5next.c +++ b/drivers/hwmon/aquacomputer_d5next.c @@ -1324,6 +1324,76 @@ static const struct hwmon_chip_info aqc_chip_info = { .info = aqc_info, }; +static bool aqc_raw_data_valid(struct aqc_data *priv, int size) +{ + int off, fan_off, i; + char *msg; + + if (!priv) + return false; + + /* +1 for get_unaligned_be16(), it reads 2 bytes */ + off = priv->serial_number_start_offset + SERIAL_PART_OFFSET + 1; + if (off >= size) { + msg = "serial number start offset"; + goto invalid; + } + + off = priv->firmware_version_offset + 1; + if (off >= size) { + msg = "firmware version offset"; + goto invalid; + } + + /* Physical temperature sensor readings data size check*/ + for (i = 0; i < priv->num_temp_sensors; i++) { + off = priv->temp_sensor_start_offset + i * AQC_SENSOR_SIZE + 1; + + if (off >= size) { + msg = "temp sensor start offset"; + goto invalid; + } + } + /* Virtual temperature sensor readings data size check*/ + for (i = 0; i < priv->num_virtual_temp_sensors; i++) { + off = priv->virtual_temp_sensor_start_offset + + i * AQC_SENSOR_SIZE + 1; + + if (off >= size) { + msg = "virtual temp sensor start offset"; + goto invalid; + } + } + + /* Fan speed and related readings data size check */ + for (i = 0; i < priv->num_fans; i++) { + fan_off = priv->fan_sensor_offsets[i] + 1; + off = fan_off + priv->fan_structure->power; + if (off >= size) { + msg = "fan power offset"; + goto invalid; + } + + off = fan_off + priv->fan_structure->voltage; + if (off >= size) { + msg = "fan voltage offset"; + goto invalid; + } + + off = fan_off + priv->fan_structure->curr; + if (off >= size) { + msg = "fan curr offset"; + goto invalid; + } + } + + return true; +invalid: + pr_debug("data size (%d) is less than the %s, %s\n", + size, msg, __func__); + return false; +} + static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size) { int i, j, sensor_value; @@ -1334,6 +1404,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 priv = hid_get_drvdata(hdev); + if (!aqc_raw_data_valid(priv, size)) + return 0; + /* Info provided with every report */ priv->serial_number[0] = get_unaligned_be16(data + priv->serial_number_start_offset); priv->serial_number[1] = get_unaligned_be16(data + priv->serial_number_start_offset + -- 2.43.0