diff options
| author | Arie Miller <renari@arimil.com> | 2026-09-03 22:21:28 -0400 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-09-09 18:16:35 -0700 |
| commit | 8042312e73c50de82634ce63eae7cf219464b481 (patch) | |
| tree | 3c857d238779753a303fbc45e65120f71c16b77b /scripts/basic/split-include.c | |
| parent | 4ee875c423c66c45d7ef7bbff403cd0e3971e0a2 (diff) | |
| download | linux-8042312e73c50de82634ce63eae7cf219464b481.tar.gz linux-8042312e73c50de82634ce63eae7cf219464b481.zip | |
hwmon: (asus_rog_ryujin) Validate HID report lengths
rog_ryujin_raw_event() parses response headers and payload fields without
first checking that they are present in the received report. A short report
can therefore make the driver consume uninitialized bytes from the HID
transport buffer and expose them as sensor values through sysfs.
Validate the response header and the fields used by each response type
before parsing them.
Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol sparse
Signed-off-by: Arie Miller <renari@arimil.com>
Link: https://patch.msgid.link/20260904022129.97896-2-renari@arimil.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions