Commit 36c4d73ce05d for kernel

commit 36c4d73ce05d1d8896c2669eb0730d35a02a2ec1
Author: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Date:   Wed Aug 5 07:19:20 2026 +0000

    hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination

    In theory it could be possible that the REPLY_SIZE sized buffers for
    holding the vendor and product strings could be end up missing the null
    termination (for example by malicious hardware built on purpose)
    required by the seq_printf() call. That limits the debugfs printf calls
    to a maximum string length of REPLY_SIZE.

    Fixes: d115b51e0e567 ("hwmon: add Corsair PSU HID controller driver")
    Signed-off-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
    Link: https://lore.kernel.org/r/anLj9gPWRoRDbQBV@monster.localdomain
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>

diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c
index ce958cdaef58..3c01ae3fc4af 100644
--- a/drivers/hwmon/corsair-psu.c
+++ b/drivers/hwmon/corsair-psu.c
@@ -701,7 +701,7 @@ static int vendor_show(struct seq_file *seqf, void *unused)
 {
 	struct corsairpsu_data *priv = seqf->private;

-	seq_printf(seqf, "%s\n", priv->vendor);
+	seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->vendor);

 	return 0;
 }
@@ -711,7 +711,7 @@ static int product_show(struct seq_file *seqf, void *unused)
 {
 	struct corsairpsu_data *priv = seqf->private;

-	seq_printf(seqf, "%s\n", priv->product);
+	seq_printf(seqf, "%.*s\n", REPLY_SIZE, priv->product);

 	return 0;
 }