[PATCH v2] hwmon: (gigabyte_waterforce) reject short input reports

[PATCH v2] hwmon: (gigabyte_waterforce) reject short input reports

[Jiale Yao]

The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.

Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.

Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---

Notes (update-waterforce-v2):
    Changes in v2:
    - Fold the command-byte and firmware-response checks into one minimum
      length check, as suggested by Guenter Roeck.
    - Drop the inaccurate hid-asus comparison from the commit message.

 drivers/hwmon/gigabyte_waterforce.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c
index 4eea05f8b569..f4d0376dd68e 100644
--- a/drivers/hwmon/gigabyte_waterforce.c
+++ b/drivers/hwmon/gigabyte_waterforce.c
@@ -257,6 +257,9 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 {
 	struct waterforce_data *priv = hid_get_drvdata(hdev);
 
+	if (size <= FIRMWARE_VER_START_OFFSET_2)
+		return 0;
+
 	if (data[0] == get_firmware_ver_cmd[0] && data[1] == get_firmware_ver_cmd[1]) {
 		/* Received a firmware version report */
 		priv->firmware_version =
@@ -269,6 +272,8 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 
 	if (data[0] != get_status_cmd[0] || data[1] != get_status_cmd[1])
 		return 0;
+	if (size <= WATERFORCE_TEMP_SENSOR)
+		return 0;
 
 	priv->temp_input[0] = data[WATERFORCE_TEMP_SENSOR] * 1000;
 	priv->speed_input[0] = get_unaligned_le16(data + WATERFORCE_FAN_SPEED);

base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.34.1

Re: [PATCH v2] hwmon: (gigabyte_waterforce) reject short input reports

[sashiko-bot]

> The HID raw_event callback runs before HID core validates the received
> report length. waterforce_raw_event() reads command bytes and then accesses
> fixed offsets for firmware or status data without any length checks. A
> truncated report can therefore cause out-of-bounds reads and update hwmon
> state with unrelated data.
> 
> Require every report to contain the firmware response fields, which also
> covers both command bytes. After identifying a status response, require
> the byte at the highest status offset before accessing its payload.
> 
> Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927084959.893708-1-yaojiale02@163.com?part=1