From 400be69515c327ced60082b27ede902a8d93cbdb Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Sun, 27 Sep 2026 16:49:59 +0800 Subject: [PATCH] hwmon: (gigabyte_waterforce) reject short input reports The HID raw_event callback runs before HID core validates the received report length. waterforce_raw_event() reads command bytes and then accesses fixed offsets for firmware or status data without any length checks. A truncated report can therefore cause out-of-bounds reads and update hwmon state with unrelated data. Require every report to contain the firmware response fields, which also covers both command bytes. After identifying a status response, require the byte at the highest status offset before accessing its payload. Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com Signed-off-by: Guenter Roeck --- drivers/hwmon/gigabyte_waterforce.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c index 4eea05f8b569..f4d0376dd68e 100644 --- a/drivers/hwmon/gigabyte_waterforce.c +++ b/drivers/hwmon/gigabyte_waterforce.c @@ -257,6 +257,9 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo { struct waterforce_data *priv = hid_get_drvdata(hdev); + if (size <= FIRMWARE_VER_START_OFFSET_2) + return 0; + if (data[0] == get_firmware_ver_cmd[0] && data[1] == get_firmware_ver_cmd[1]) { /* Received a firmware version report */ priv->firmware_version = @@ -269,6 +272,8 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo if (data[0] != get_status_cmd[0] || data[1] != get_status_cmd[1]) return 0; + if (size <= WATERFORCE_TEMP_SENSOR) + return 0; priv->temp_input[0] = data[WATERFORCE_TEMP_SENSOR] * 1000; priv->speed_input[0] = get_unaligned_le16(data + WATERFORCE_FAN_SPEED);