[PATCH] hwmon: (aquacomputer_d5next) reject short status reports

[Jiale Yao]

The HID driver raw_event callback runs before HID core validates the
received report length.  aqc_raw_event() reads device-specific status
fields at fixed offsets, including multi-byte values, without checking
that the received buffer contains the complete report.  A truncated status
report can therefore cause out-of-bounds reads and update hwmon state with
data beyond the received report.

Reject status reports shorter than the length derived from their report
descriptor before accessing any fields.  Commit 47669bec44fe ("HID: asus:
refactor the two workqueues and init sequence") added equivalent raw-event
length validation to hid-asus.

Fixes: 0e35f63f7f4e ("hwmon: add driver for Aquacomputer D5 Next")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hwmon/aquacomputer_d5next.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/aquacomputer_d5next.c b/drivers/hwmon/aquacomputer_d5next.c
index 1ca70e726298..1ebc8bc4c090 100644
--- a/drivers/hwmon/aquacomputer_d5next.c
+++ b/drivers/hwmon/aquacomputer_d5next.c
@@ -1331,6 +1331,8 @@ static int aqc_raw_event(struct hid_device *hdev, struct hid_report *report, u8
 
 	if (report->id != STATUS_REPORT_ID)
 		return 0;
+	if (size < hid_report_len(report))
+		return 0;
 
 	priv = hid_get_drvdata(hdev);
 
-- 
2.34.1