hwmon: (corsair-cpro) Validate the size of the received input buffer

[ Upstream commit 495a4f0dce9c8c4478c242209748f1ee9e4d5820 ]

Add buffer_recv_size to store the size of the received bytes.
Validate buffer_recv_size in send_usb_cmd().

Reported-by: syzbot+3bbbade4e1a7ab45ca3b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-hwmon/61233ba1-e5ad-4d7a-ba31-3b5d0adcffcc@roeck-us.net
Fixes: 40c3a4454225 ("hwmon: add Corsair Commander Pro driver")
Signed-off-by: Marius Zachmann <mail@mariuszachmann.de>
Link: https://lore.kernel.org/r/20250619132817.39764-5-mail@mariuszachmann.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c
index 05df31cab2e522ce516a5c1c77051a5a4016f1f7..074f812332e89bb867d27ff1363397565e9fe4f9 100644 (file)
--- a/drivers/hwmon/corsair-cpro.c
+++ b/drivers/hwmon/corsair-cpro.c
@@ -84,6 +84,7 @@ struct ccp_device {
        struct mutex mutex; /* whenever buffer is used, lock before send_usb_cmd */
        u8 *cmd_buffer;
        u8 *buffer;
+       int buffer_recv_size; /* number of received bytes in buffer */
        int target[6];
        DECLARE_BITMAP(temp_cnct, NUM_TEMP_SENSORS);
        DECLARE_BITMAP(fan_cnct, NUM_FANS);
@@ -139,6 +140,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
        if (!t)
                return -ETIMEDOUT;
 
+       if (ccp->buffer_recv_size != IN_BUFFER_SIZE)
+               return -EPROTO;
+
        return ccp_get_errno(ccp);
 }
 
@@ -150,6 +154,7 @@ static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8
        spin_lock(&ccp->wait_input_report_lock);
        if (!completion_done(&ccp->wait_input_report)) {
                memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
+               ccp->buffer_recv_size = size;
                complete_all(&ccp->wait_input_report);
        }
        spin_unlock(&ccp->wait_input_report_lock);