Re: [PATCH] hwmon: (aquacomputer_d5next) Add AMPINEL support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The driver unconditionally casts the device parent to a `usb_interface` without verifying that the device is actually bound to a USB transport, which can lead to an invalid cast and kernel crash.
--

commit ab9f1cda999fbdfa626d75acef47522f86ec7022
Author: Vas Zayarskiy <contact@vasily.cc>

hwmon: (aquacomputer_d5next) Add AMPINEL support

This commit adds read-only hardware monitoring support for the Aquacomputer
AMPINEL power monitor. It decodes the USB HID input reports to expose total
power, voltage, current, and temperature telemetry through standard hwmon
interfaces.

> diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
> index 1ca70e7262988..b33d0ccc02183 100644
> --- a/drivers/hwmon/aquacomputer_d5next.c
> +++ b/drivers/hwmon/aquacomputer_d5next.c
[ ... ]
> @@ -1533,6 +1626,27 @@ static int aqc_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  	if (ret)
>  		return ret;
>  
> +	if (hdev->product == USB_PRODUCT_ID_AMPINEL) {
> +		intf = to_usb_interface(hdev->dev.parent);

[Severity: Critical]
Is it safe to cast the parent device to a usb_interface here without first
verifying that this is a USB device?

If a non-USB HID device matching this vendor (0x0c70) and product (0xf015) ID
is registered (for example, spoofed over Bluetooth or by a local attacker
using /dev/uhid), to_usb_interface() will perform an invalid cast. 

The subsequent dereference of intf->cur_altsetting could then cause an OOPS
or memory corruption due to type confusion.

Would it be better to add a hid_is_usb(hdev) check before attempting this
cast?

> +		/*
> +		 * hid-generic yields every interface matching our product ID.
> +		 * Preserve input and hidraw on the separate keyboard interface.
> +		 */
> +		if (intf->cur_altsetting->desc.bInterfaceNumber != AMPINEL_DATA_INTERFACE) {
> +			hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
> +			return hid_hw_start(hdev, HID_CONNECT_DEFAULT);
> +		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914195759.171524-1-contact@vasily.cc?part=1