From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831235; b=rccWOADABv3rZY0uIAPoN00KD6Z31SJxnsLYyL/ahiKG0X/bxWT7TmS8xQyAFrh/YZek jZmbhOeqA4qUVMHWrZvYwsN9ssAeFQmR0ZtpyCZOBhR++O7gtu4hxDyVJF7VsvMnmivfL xnclgc+4bvu3W7nXOu3zYGMdR0YoU+ymCPRfsDAhpenQQOR3UbHgGz8c8etiZL0sDKRzo C+lv7g8VXuugZ6TrjdyNegwztO9RVCvnQ67lTrCuWSiYhm45G2Uc8LcN9/iL5/5/Lms7k u8lhHtaizks/cO07MbQVjBxGw6w0/RIm+1ce2tb/xO8avhSkjhMsuiHePjNgrq2iQNQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831235; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=FlWuao+5MaS2tb9wE+4oHCWEy/OCRlFjFvGUtbm0RgY=; b=5Efudk93zT0edZNx1E/Pfiiozv42jTM0hdAUJjzIxb+LC66yVoqIWAbA9pTWEloa2az/ 4FbXQW13wuhAjeDF2xvjqlLzxNf+h5Piokj8dURDx0UU0T2VvqkJH2B1McmvkQu2vXUwy /S/cOy3iBZyJBuQRD8VBaWq0Hx1pGQCcD6diJ/HuVKm1rZ6aiVuhw2QOlm+nFe/5vdbU+ 3tcPo69rEaZLsJ9Fp1iwLpBVcV3kWLJkq+YpbK06iSz1nnPSLYFySo0mlf2wEfhTDdBXW 7Rf7fLdmg/SA7J7gewenpbDjahtUjU7ImTrNyQZHJZftPEeAxlKJLwG7CgQZ2PeKahA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FgFD8sx8; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65480606AB32; Wed, 4 Nov 2026 22:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FgFD8sx8 Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE9201F000C1; Wed, 4 Nov 2026 22:27:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831235; bh=FlWuao+5MaS2tb9wE+4oHCWEy/OCRlFjFvGUtbm0RgY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FgFD8sx8WHsPADAgiZb5DLl+JWRPBGDwZf/Vse766XafH2aoZTFe9c8f8uFA+ZMqL PK02i2p5cOyqWmb+VOSbUBVxD0i4W0FrmhOCjxWFRQAB/P/ZCQRGem0jNnensD7lad qVF778LG8l2xnMiAi49gTZsZ4cihok7BJJIu+EMQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sashiko , Arie Miller , Guenter Roeck , Sasha Levin Subject: [PATCH 6.18 0580/1005] hwmon: (asus_rog_ryujin) Validate HID report lengths Date: Wed, 4 Nov 2026 16:05:13 -0500 Message-ID: <20261104211100.103312526@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arie Miller [ Upstream commit 8042312e73c50de82634ce63eae7cf219464b481 ] rog_ryujin_raw_event() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs. Validate the response header and the fields used by each response type before parsing them. Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler") Reported-by: Sashiko Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller Link: https://patch.msgid.link/20260904022129.97896-2-renari@arimil.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin --- drivers/hwmon/asus_rog_ryujin.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/hwmon/asus_rog_ryujin.c b/drivers/hwmon/asus_rog_ryujin.c index 80563ce38519d..593950802b39d 100644 --- a/drivers/hwmon/asus_rog_ryujin.c +++ b/drivers/hwmon/asus_rog_ryujin.c @@ -411,10 +411,15 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo { struct rog_ryujin_data *priv = hid_get_drvdata(hdev); - if (data[0] != RYUJIN_CMD_PREFIX) + if (size < 2 || data[0] != RYUJIN_CMD_PREFIX) return 0; if (data[1] == RYUJIN_GET_COOLER_STATUS_CMD_RESPONSE) { + if (size <= priv->info->temp_offset + 1 || + size <= priv->info->pump_speed_offset + 1 || + size <= priv->info->fan_speed_offset + 1) + return 0; + /* Received coolant temp and speeds of pump and internal fan */ priv->temp_input[0] = data[priv->info->temp_offset] * 1000 + data[priv->info->temp_offset + 1] * 100; @@ -426,6 +431,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo if (!completion_done(&priv->cooler_status_received)) complete_all(&priv->cooler_status_received); } else if (data[1] == RYUJIN_GET_CONTROLLER_SPEED_CMD_RESPONSE) { + if (size <= RYUJIN_CONTROLLER_SPEED_3 + 1) + return 0; + /* Received speeds of four fans attached to the controller */ priv->speed_input[2] = get_unaligned_le16(data + RYUJIN_CONTROLLER_SPEED_1); priv->speed_input[3] = get_unaligned_le16(data + RYUJIN_CONTROLLER_SPEED_2); @@ -435,6 +443,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo if (!completion_done(&priv->controller_status_received)) complete_all(&priv->controller_status_received); } else if (data[1] == RYUJIN_GET_COOLER_DUTY_CMD_RESPONSE) { + if (size <= RYUJIN_INTERNAL_FAN_DUTY) + return 0; + /* Received report for pump and internal fan duties (in %) */ if (data[RYUJIN_PUMP_DUTY] == 0 && data[RYUJIN_INTERNAL_FAN_DUTY] == 0) { /* @@ -461,6 +472,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo if (!completion_done(&priv->cooler_duty_received)) complete_all(&priv->cooler_duty_received); } else if (data[1] == RYUJIN_GET_CONTROLLER_DUTY_CMD_RESPONSE) { + if (size <= RYUJIN_CONTROLLER_DUTY) + return 0; + /* Received report for controller duty for fans (in PWM) */ if (data[RYUJIN_CONTROLLER_DUTY] == 0) { /* -- 2.53.0