diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-27 16:49:59 +0800 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-10-19 05:48:34 -0700 |
| commit | 400be69515c327ced60082b27ede902a8d93cbdb (patch) | |
| tree | f42c4926b94147ce6108d47d8bf4f4e2deadb11e /tools/perf/scripts/python/stackcollapse.py | |
| parent | 37c1974a0ec4ec4624a270291a179c53f8f4fbca (diff) | |
| download | linux-400be69515c327ced60082b27ede902a8d93cbdb.tar.gz linux-400be69515c327ced60082b27ede902a8d93cbdb.zip | |
hwmon: (gigabyte_waterforce) reject short input reports
The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.
Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.
Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions