DF-4547
lm_setup_sensors copies sensor tables into sc->sensors[WB_MAX_SENSORS] with no bound — w83792d_sensors already fills all 19 slots, zero headroom
Summary
The loop is bounded only by the table NULL terminator, never by WB_MAX_SENSORS; the largest current table fills all 19 slots exactly, so any future added row (or new chip table) silently overflows into the rest of the softc at probe time. Compile-time data only - hardening. Bound-the-loop fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4547 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 832 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
bound-the-loop fix in finding markdown
per-fix-DF-4547
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Loop bounded only by the table NULL terminator, never by WB_MAX_SENSORS; w83792d already fills all 19 slots (zero headroom). Compile-time data only, no attacker control.
Verdict
not_run: Info hardening, no runtime surface
No comments yet.