From 73f46553fd74a1fc56eb2e6218ff3a4ea1de43b5 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Tue, 30 Jun 2026 14:57:38 +0800 Subject: [PATCH] w1: validate slave string length before checking separator w1_atoreg_num() checks buf[2] for the family/id separator before proving the input contains that byte. Require at least the family and separator prefix before checking the separator. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/2026063007047999.4-ccfa108-0039-w1-validate-slave-string-le-pengpeng@iscas.ac.cn Signed-off-by: Krzysztof Kozlowski --- drivers/w1/w1.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c index 486f321eadc8..c16946642789 100644 --- a/drivers/w1/w1.c +++ b/drivers/w1/w1.c @@ -403,6 +403,11 @@ static int w1_atoreg_num(struct device *dev, const char *buf, size_t count, const char *error_msg = "bad slave string format, expecting " "ff-dddddddddddd\n"; + if (count < 3) { + dev_err(dev, "%s", error_msg); + return -EINVAL; + } + if (buf[2] != '-') { dev_err(dev, "%s", error_msg); return -EINVAL;