diff options
| author | Wilken Gottwalt <wilken.gottwalt@posteo.net> | 2026-08-05 07:19:20 +0000 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-08-06 22:37:38 -0700 |
| commit | 36c4d73ce05d1d8896c2669eb0730d35a02a2ec1 (patch) | |
| tree | 859aba04c7ae1fe1c2244efc5b9a02a73d07be5d /drivers | |
| parent | 0dabe8a56f772f0ece46d2597799f412c277d874 (diff) | |
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
In theory it could be possible that the REPLY_SIZE sized buffers for
holding the vendor and product strings could be end up missing the null
termination (for example by malicious hardware built on purpose)
required by the seq_printf() call. That limits the debugfs printf calls
to a maximum string length of REPLY_SIZE.
Fixes: d115b51e0e567 ("hwmon: add Corsair PSU HID controller driver")
Signed-off-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Link: https://lore.kernel.org/r/anLj9gPWRoRDbQBV@monster.localdomain
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/hwmon/corsair-psu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c index ce958cdaef58..3c01ae3fc4af 100644 --- a/drivers/hwmon/corsair-psu.c +++ b/drivers/hwmon/corsair-psu.c @@ -701,7 +701,7 @@ static int vendor_show(struct seq_file *seqf, void *unused) { struct corsairpsu_data *priv = seqf->private; - seq_printf(seqf, "%s\n", priv->vendor); + seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->vendor); return 0; } @@ -711,7 +711,7 @@ static int product_show(struct seq_file *seqf, void *unused) { struct corsairpsu_data *priv = seqf->private; - seq_printf(seqf, "%s\n", priv->product); + seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->product); return 0; } |