[syzbot] [hwmon?] KASAN: slab-out-of-bounds Read in aqc_raw_event

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e1e6e541c5c9 Merge tag 'thunderbolt-for-v7.3-rc1' of ssh:/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=16086e79580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bdeea7ee6735f91
dashboard link: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14737679580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a22549580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3b0a1f8e6a1f/disk-e1e6e541.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f98d855e85e8/vmlinux-e1e6e541.xz
kernel image: https://storage.googleapis.com/syzbot-assets/db2c3a41df6d/bzImage-e1e6e541.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in get_unaligned_be16 include/linux/unaligned.h:48 [inline]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
Read of size 2 at addr ffff888108aba257 by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
get_unaligned_be16 include/linux/unaligned.h:48 [inline]
aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 60 ab 01 e9 83 f7 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 ef 09 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc9000013fe10 EFLAGS: 00000246
RAX: 000000000004b053 RBX: ffff8881022d9e00 RCX: ffffffff877c9945
RDX: 0000000000000000 RSI: ffffffff890f4061 RDI: ffffffff87b15700
RBP: ffffed102045b3c0 R08: 0000000000000001 R09: ffffed103eae670d
R10: ffff8881f573386b R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000027fc6 R15: dffffc0000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:768
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x3a7/0x5b0 kernel/sched/idle.c:355
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x158
</TASK>

Allocated by task 23:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x309/0x7c0 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
hcd_buffer_alloc+0x1f5/0x290 drivers/usb/core/buffer.c:134
usb_alloc_coherent+0x5f/0xa0 drivers/usb/core/usb.c:1011
hid_alloc_buffers drivers/hid/usbhid/hid-core.c:859 [inline]
usbhid_start+0x5cf/0x23a0 drivers/hid/usbhid/hid-core.c:1108
hid_hw_start+0x65/0x140 drivers/hid/hid-core.c:2428
aqc_probe+0x1a5/0x3510 drivers/hwmon/aquacomputer_d5next.c:1536
__hid_device_probe drivers/hid/hid-core.c:2829 [inline]
hid_device_probe+0x50e/0x800 drivers/hid/hid-core.c:2866
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
hid_add_device+0x2bf/0x440 drivers/hid/hid-core.c:3010
usbhid_probe+0xa64/0x10b0 drivers/hid/usbhid/hid-core.c:1452
usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708
usb_new_device drivers/usb/core/hub.c:5833 [inline]
hub_port_connect drivers/usb/core/hub.c:5580 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888108aba200
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 22 bytes to the right of
allocated 65-byte region [ffff888108aba200, ffff888108aba241)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888108aba680 pfn:0x108aba
flags: 0x200000000000200(workingset|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000200 ffff888100041280 ffff8881000401c8 ffffea00046bf250
raw: ffff888108aba680 0000000800200017 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11, tgid 11 (kworker/0:1), ts 4259009323, free_ts 4258897945
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab mm/slub.c:3380 [inline]
new_slab+0xa2/0x670 mm/slub.c:3426
refill_objects+0xe3/0x410 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
__kmalloc_cache_node_noprof+0x4b3/0x670 mm/slub.c:5504
_kmalloc_node_noprof include/linux/slab.h:1193 [inline]
__get_vm_area_node+0x101/0x330 mm/vmalloc.c:3237
__vmalloc_node_range_noprof+0x228/0x1630 mm/vmalloc.c:4064
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
__vmalloc_noprof+0xa3/0x120 mm/vmalloc.c:4181
pcpu_mem_zalloc+0x54/0xb0 mm/percpu.c:512
pcpu_alloc_chunk mm/percpu.c:1449 [inline]
pcpu_create_chunk+0x119/0x620 mm/percpu-vm.c:338
pcpu_balance_populated mm/percpu.c:2073 [inline]
pcpu_balance_workfn+0xb2c/0xdc0 mm/percpu.c:2215
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
page last free pid 11 tgid 11 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x716/0xf50 mm/page_alloc.c:2950
__kasan_populate_vmalloc_do mm/kasan/shadow.c:393 [inline]
__kasan_populate_vmalloc+0x1ea/0x210 mm/kasan/shadow.c:424
kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
alloc_vmap_area+0x95d/0x2bb0 mm/vmalloc.c:2145
__get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3248
__vmalloc_node_range_noprof+0x228/0x1630 mm/vmalloc.c:4064
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
__vmalloc_noprof+0xa3/0x120 mm/vmalloc.c:4181
pcpu_mem_zalloc+0x54/0xb0 mm/percpu.c:512
pcpu_alloc_chunk mm/percpu.c:1444 [inline]
pcpu_create_chunk+0xce/0x620 mm/percpu-vm.c:338
pcpu_balance_populated mm/percpu.c:2073 [inline]
pcpu_balance_workfn+0xb2c/0xdc0 mm/percpu.c:2215
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
ffff888108aba100: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff888108aba180: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
>ffff888108aba200: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
^
ffff888108aba280: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
ffff888108aba300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
0: e9 83 f7 02 00 jmp 0x2f788
5: 0f 1f 00 nopl (%rax)
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: f3 0f 1e fa endbr64
1c: 66 90 xchg %ax,%ax
1e: 0f 00 2d 23 ef 09 00 verw 0x9ef23(%rip) # 0x9ef48
25: fb sti
26: f4 hlt
* 27: c3 ret <-- trapping instruction
28: cc int3
29: cc int3
2a: cc int3
2b: cc int3
2c: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
33: 00 00 00
36: 66 90 xchg %ax,%ax
38: 90 nop
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Guenter Roeck]

Aleksa,

On 8/21/26 20:06, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e1e6e541c5c9 Merge tag 'thunderbolt-for-v7.3-rc1' of ssh:/..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=16086e79580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=8bdeea7ee6735f91
> dashboard link: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14737679580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a22549580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/3b0a1f8e6a1f/disk-e1e6e541.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/f98d855e85e8/vmlinux-e1e6e541.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/db2c3a41df6d/bzImage-e1e6e541.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in get_unaligned_be16 include/linux/unaligned.h:48 [inline]
> BUG: KASAN: slab-out-of-bounds in aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
> BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327

The problem is that syzkaller sends a bad (short) report.
aqc_raw_event() needs to validate the report size and bail out
if it is short. The fix should be straightforard if it is known
what the minimum report size is. D5NEXT_CTRL_REPORT_SIZE ?

Thanks,
Guenter

[Edward Adam Davis]

#syz test

diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..1cc6c220ffe9 100644
--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1334,6 +1334,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8

priv = hid_get_drvdata(hdev);

+ if (size < priv->buffer_size)
+ return 0;
+
/* Info provided with every report */
priv->serial_number[0] = get_unaligned_be16(data + priv->serial_number_start_offset);
priv->serial_number[1] = get_unaligned_be16(data + priv->serial_number_start_offset +

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com

Tested on:

commit: e1e6e541 Merge tag 'thunderbolt-for-v7.3-rc1' of ssh:/..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing

console output: https://syzkaller.appspot.com/x/log.txt?x=104d2179580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8bdeea7ee6735f91
dashboard link: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=17dd5e79580000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
fails to handle cases where the sensor data length is smaller than the buffer
size when reading the data, resulting in [1] during the read process.

Add a check for the data size, if it less than the buffer size, the sensor
data read is aborted.

[1]

BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
Read of size 2 at addr ffff888108aba257 by task swapper/1/0

Call Trace:

get_unaligned_be16 include/linux/unaligned.h:48 [inline]
aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741

Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
drivers/hwmon/aquacomputer_d5next.c | 3 +++
1 file changed, 3 insertions(+)

--
2.43.0

[Guenter Roeck]

Subject is supposed to be "hwmon: (driver) Description".

On 8/21/26 22:34, Edward Adam Davis wrote:
> The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
> fails to handle cases where the sensor data length is smaller than the buffer
> size when reading the data, resulting in [1] during the read process.
>

The device simulated by syzbot is D5 next, and its control buffer size is
0x329 or 809. I _asked_ earlier if that is the value to check against,
but did not claim that this is actually the case.

We know that the report must be much longer than 65 bytes. D5NEXT_PUMP_OFFSET
is 0x6c = 108, and the field is two bytes long, meaning the report size
must be at least 110 bytes long. What we do not know is its actual length.

> Add a check for the data size, if it less than the buffer size, the sensor
> data read is aborted.
>

Apparently Sashiko is aware that this is wrong - not only is the report size
smaller than 809 bytes, but apparently buffer_size is not even set for all
supported devices.

Please do not submit a patch to fix this problem if you can not test if
the code actually works.

Thanks,
Guenter

[Edward Adam Davis]

#syz test

diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..c4c8e806db95 100644
--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1324,6 +1324,75 @@ static const struct hwmon_chip_info aqc_chip_info = {
.info = aqc_info,
};

+static bool aqc_raw_data_valid(struct aqc_data *priv, int size)
+{
+ int off;
+ char *msg;
+
+ if (!priv)
+ return false;
+
+ off = priv->serial_number_start_offset + SERIAL_PART_OFFSET;
+ if (off >= size) {
+ msg = "serial number start offset";
+ goto invalid;
+ }
+
+ off = priv->firmware_version_offset;
+ if (off >= size) {
+ msg = "firmware version offset";
+ goto invalid;
+ }
+
+ /* Physical temperature sensor readings data size check*/
+ if (priv->num_temp_sensors > 0) {
+ off = priv->temp_sensor_start_offset +
+ (priv->num_temp_sensors - 1) * AQC_SENSOR_SIZE;
+
+ if (off >= size) {
+ msg = "temp sensor start offset";
+ goto invalid;
+ }
+ }
+ /* Virtual temperature sensor readings data size check*/
+ if (priv->num_virtual_temp_sensors > 0) {
+ off = priv->virtual_temp_sensor_start_offset +
+ (priv->num_virtual_temp_sensors - 1) * AQC_SENSOR_SIZE;
+
+ if (off >= size) {
+ msg = "virtual temp sensor start offset";
+ goto invalid;
+ }
+ }
+ /* Fan speed and related readings data size check */
+ if (priv->num_fans > 0) {
+ int fan_off = priv->fan_sensor_offsets[priv->num_fans - 1];
+
+ off = fan_off + priv->fan_structure->power;
+ if (off >= size) {
+ msg = "fan power offset";
+ goto invalid;
+ }
+
+ off = fan_off + priv->fan_structure->voltage;
+ if (off >= size) {
+ msg = "fan voltage offset";
+ goto invalid;
+ }
+
+ off = fan_off + priv->fan_structure->curr;
+ if (off >= size) {
+ msg = "fan curr offset";
+ goto invalid;
+ }
+ }
+
+ return true;
+invalid:
+ pr_debug("data size (%d) is less than the %s, %s\n", size, msg, __func__);
+ return false;
+}
+
static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
{
int i, j, sensor_value;
@@ -1334,6 +1403,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8

priv = hid_get_drvdata(hdev);

+ if (!aqc_raw_data_valid(priv, size))

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com

Tested on:

commit: e1e6e541 Merge tag 'thunderbolt-for-v7.3-rc1' of ssh:/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing

console output: https://syzkaller.appspot.com/x/log.txt?x=11872179580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8bdeea7ee6735f91
dashboard link: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=15119179580000

[Edward Adam Davis]

The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()

fails to handle cases where the sensor data length is too small when reading

the data, resulting in [1] during the read process.

Add a data size check, if the size is less than that required for the
specific data item to be read, abort the sensor data read operation.

[1]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
Read of size 2 at addr ffff888108aba257 by task swapper/1/0
Call Trace:
get_unaligned_be16 include/linux/unaligned.h:48 [inline]
aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741

Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---

v1 -> v2: change to check the data item and update comments

drivers/hwmon/aquacomputer_d5next.c | 73 +++++++++++++++++++++++++++++
1 file changed, 73 insertions(+)

diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..c6fe36abfe56 100644
--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1324,6 +1324,76 @@ static const struct hwmon_chip_info aqc_chip_info = {

+ size, msg, __func__);

+ return false;
+}
+
static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
{
int i, j, sensor_value;

@@ -1334,6 +1404,9 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8

priv = hid_get_drvdata(hdev);

+ if (!aqc_raw_data_valid(priv, size))
+ return 0;
+
/* Info provided with every report */
priv->serial_number[0] = get_unaligned_be16(data + priv->serial_number_start_offset);
priv->serial_number[1] = get_unaligned_be16(data + priv->serial_number_start_offset +

--
2.43.0

[Edward Adam Davis]

On Fri, 21 Aug 2026 23:41:26 -0700, Guenter Roeck wrote:
> Subject is supposed to be "hwmon: (driver) Description".

Oh, got it.

>
> On 8/21/26 22:34, Edward Adam Davis wrote:
> > The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
> > fails to handle cases where the sensor data length is smaller than the buffer
> > size when reading the data, resulting in [1] during the read process.
> >
>
> The device simulated by syzbot is D5 next, and its control buffer size is
> 0x329 or 809. I _asked_ earlier if that is the value to check against,
> but did not claim that this is actually the case.
>
> We know that the report must be much longer than 65 bytes. D5NEXT_PUMP_OFFSET
> is 0x6c = 108, and the field is two bytes long, meaning the report size
> must be at least 110 bytes long. What we do not know is its actual length.
>
> > Add a check for the data size, if it less than the buffer size, the sensor
> > data read is aborted.
> >
>
> Apparently Sashiko is aware that this is wrong - not only is the report size
> smaller than 809 bytes, but apparently buffer_size is not even set for all
> supported devices.

Yes, I also realized that relying solely on the buffer size for the check
might be too simplistic or crude, so I adjusted the data length verification
method and submitted a second version of the patch.

BR,
Edward

[Guenter Roeck]

On 8/22/26 00:45, Edward Adam Davis wrote:
> The user-forged sensor data is only 65 bytes long; however, aqc_raw_event()
> fails to handle cases where the sensor data length is too small when reading
> the data, resulting in [1] during the read process.
>
> Add a data size check, if the size is less than that required for the
> specific data item to be read, abort the sensor data read operation.
>
> [1]
> BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
> Read of size 2 at addr ffff888108aba257 by task swapper/1/0
> Call Trace:
> get_unaligned_be16 include/linux/unaligned.h:48 [inline]
> aqc_raw_event drivers/hwmon/aquacomputer_d5next.c:1345 [inline]
> aqc_raw_event+0x213e/0x25d0 drivers/hwmon/aquacomputer_d5next.c:1327
> __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
> hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
> __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
> usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
>
> Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
> Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
> Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <ead...@qq.com>
> ---
> v1 -> v2: change to check the data item and update comments

Please stop sending me AI generated patches. Whatever model you are using
has no clue what it is doing.

Guenter

[Edward Adam Davis]

#syz test

diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..5621434af768 100644

--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1324,6 +1324,76 @@ static const struct hwmon_chip_info aqc_chip_info = {
.info = aqc_info,
};

+static bool aqc_raw_data_valid(struct aqc_data *priv, int size)
+{

+ int off, fan_off, i;

+ char *msg;
+
+ if (!priv)
+ return false;
+

+ /* +1 for get_unaligned_be16(), it reads 2 bytes */
+ off = priv->serial_number_start_offset + SERIAL_PART_OFFSET + 1;

+ if (off >= size) {
+ msg = "serial number start offset";
+ goto invalid;
+ }
+

+ off = priv->firmware_version_offset + 1;

+ if (off >= size) {
+ msg = "firmware version offset";
+ goto invalid;
+ }
+
+ /* Physical temperature sensor readings data size check*/

+ for (i = 0; i < priv->num_temp_sensors; i++) {
+ off = priv->temp_sensor_start_offset + i * AQC_SENSOR_SIZE + 1;

+
+ if (off >= size) {
+ msg = "temp sensor start offset";
+ goto invalid;
+ }
+ }
+ /* Virtual temperature sensor readings data size check*/

+ for (i = 0; i < priv->num_virtual_temp_sensors; i++) {

+ off = priv->virtual_temp_sensor_start_offset +

+ i * AQC_SENSOR_SIZE + 1;

+
+ if (off >= size) {
+ msg = "virtual temp sensor start offset";
+ goto invalid;
+ }
+ }
+
+ /* Fan speed and related readings data size check */

+ for (i = 0; i < priv->num_fans; i++) {
+ fan_off = priv->fan_sensor_offsets[i] + 1;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+9ee5f5...@syzkaller.appspotmail.com
Tested-by: syzbot+9ee5f5...@syzkaller.appspotmail.com

Tested on:

commit: e1e6e541 Merge tag 'thunderbolt-for-v7.3-rc1' of ssh:/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing

console output: https://syzkaller.appspot.com/x/log.txt?x=13849549580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8bdeea7ee6735f91
dashboard link: https://syzkaller.appspot.com/bug?extid=9ee5f5dc18673d6b2f37
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=13a59179580000