* [PATCH v2] hwmon: valid the data size before reading the sensor data
[not found] <20260822054428.D55F71F000E9@smtp.kernel.org>
@ 2026-08-22 7:45 ` Edward Adam Davis
2026-08-22 7:54 ` Guenter Roeck
0 siblings, 1 reply; 2+ messages in thread
From: Edward Adam Davis @ 2026-08-22 7:45 UTC (permalink / raw)
To: sashiko-bot
Cc: linux-hwmon, linux-kernel, linux-usb, linux, me, savicaleksa83,
syzkaller-bugs
The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
fails to handle cases where the sensor data length is too small when reading
the data, resulting in [1] during the read process.
Add a data size check, if the size is less than that required for the
specific data item to be read, abort the sensor data read operation.
[1]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
Read of size 2 at addr ffff888108aba257 by task swapper/1/0
Call Trace:
get_unaligned_be16 include/linux/unaligned.h:48 [inline]
aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
Reported-by: syzbot+9ee5f5dc18673d6b2f37@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
Tested-by: syzbot+9ee5f5dc18673d6b2f37@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
v1 -> v2: change to check the data item and update comments
drivers/hwmon/aquacomputer_d5next.c | 73 +++++++++++++++++++++++++++++
1 file changed, 73 insertions(+)
diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..c6fe36abfe56 100644
--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1324,6 +1324,76 @@ static const struct hwmon_chip_info aqc_chip_info = {
.info = aqc_info,
};
+static bool aqc_raw_data_valid(struct aqc_data *priv, int size)
+{
+ int off;
+ char *msg;
+
+ if (!priv)
+ return false;
+
+ off = priv->serial_number_start_offset + SERIAL_PART_OFFSET;
+ if (off >= size) {
+ msg = "serial number start offset";
+ goto invalid;
+ }
+
+ off = priv->firmware_version_offset;
+ if (off >= size) {
+ msg = "firmware version offset";
+ goto invalid;
+ }
+
+ /* Physical temperature sensor readings data size check*/
+ if (priv->num_temp_sensors > 0) {
+ off = priv->temp_sensor_start_offset +
+ (priv->num_temp_sensors - 1) * AQC_SENSOR_SIZE;
+
+ if (off >= size) {
+ msg = "temp sensor start offset";
+ goto invalid;
+ }
+ }
+ /* Virtual temperature sensor readings data size check*/
+ if (priv->num_virtual_temp_sensors > 0) {
+ off = priv->virtual_temp_sensor_start_offset +
+ (priv->num_virtual_temp_sensors - 1) * AQC_SENSOR_SIZE;
+
+ if (off >= size) {
+ msg = "virtual temp sensor start offset";
+ goto invalid;
+ }
+ }
+ /* Fan speed and related readings data size check */
+ if (priv->num_fans > 0) {
+ int fan_off = priv->fan_sensor_offsets[priv->num_fans - 1];
+
+ off = fan_off + priv->fan_structure->power;
+ if (off >= size) {
+ msg = "fan power offset";
+ goto invalid;
+ }
+
+ off = fan_off + priv->fan_structure->voltage;
+ if (off >= size) {
+ msg = "fan voltage offset";
+ goto invalid;
+ }
+
+ off = fan_off + priv->fan_structure->curr;
+ if (off >= size) {
+ msg = "fan curr offset";
+ goto invalid;
+ }
+ }
+
+ return true;
+invalid:
+ pr_debug("data size (%d) is less than the %s, %s\n",
+ size, msg, __func__);
+ return false;
+}
+
static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
{
int i, j, sensor_value;
@@ -1334,6 +1404,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8
priv = hid_get_drvdata(hdev);
+ if (!aqc_raw_data_valid(priv, size))
+ return 0;
+
/* Info provided with every report */
priv->serial_number[0] = get_unaligned_be16(data + priv->serial_number_start_offset);
priv->serial_number[1] = get_unaligned_be16(data + priv->serial_number_start_offset +
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread