Re: [PATCH v2] hwmon: (gigabyte_waterforce) reject short input reports

[Guenter Roeck]

On Sun, Sep 27, 2026 at 04:49:59PM +0800, Jiale Yao wrote:
> The HID raw_event callback runs before HID core validates the received
> report length. waterforce_raw_event() reads command bytes and then accesses
> fixed offsets for firmware or status data without any length checks. A
> truncated report can therefore cause out-of-bounds reads and update hwmon
> state with unrelated data.
> 
> Require every report to contain the firmware response fields, which also
> covers both command bytes. After identifying a status response, require
> the byte at the highest status offset before accessing its payload.
> 
> Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>

Applied.

Thanks,
Guenter