]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
authorWilken Gottwalt <wilken.gottwalt@posteo.net>
Wed, 5 Aug 2026 07:19:20 +0000 (07:19 +0000)
committerGuenter Roeck <linux@roeck-us.net>
Fri, 7 Aug 2026 05:37:38 +0000 (22:37 -0700)
commit36c4d73ce05d1d8896c2669eb0730d35a02a2ec1
tree859aba04c7ae1fe1c2244efc5b9a02a73d07be5d
parent0dabe8a56f772f0ece46d2597799f412c277d874
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination

In theory it could be possible that the REPLY_SIZE sized buffers for
holding the vendor and product strings could be end up missing the null
termination (for example by malicious hardware built on purpose)
required by the seq_printf() call. That limits the debugfs printf calls
to a maximum string length of REPLY_SIZE.

Fixes: d115b51e0e567 ("hwmon: add Corsair PSU HID controller driver")
Signed-off-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Link: https://lore.kernel.org/r/anLj9gPWRoRDbQBV@monster.localdomain
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
drivers/hwmon/corsair-psu.c