github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

platform/wmi: Extend wmidev_query_block() to reject undersized data

Browse Source 
WMI drivers using the buffer-based WMI API are expected to reject
undersized query results. Extend wmidev_query_block() to enable
the WMI driver core to perform this size check internally.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Armin Wolf 2026-04-06 22:32:36 +02:00 committed by Ilpo Järvinen
parent 96b1b053e1
commit 1aeded2f55
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
4 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/platform/wmi/core.c
View File

@ -565,13 +565,15 @@ EXPORT_SYMBOL_GPL(wmidev_block_query);
* @wdev: A wmi bus device from a driver
* @instance: Instance index
* @out: WMI buffer to fill
* @min_size: Minimum size of the result data in bytes
*
* Query a WMI data block, the caller must free the resulting data inside @out.
* Said data is guaranteed to be aligned on a 8-byte boundary.
* Query a WMI data block, the caller must free the resulting data inside @out
* using kfree(). Said data is guaranteed to be aligned on a 8-byte boundary.
*
* Return: 0 on success or a negative error code on failure.
*/
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out)
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out,
size_t min_size)
{
union acpi_object *obj;
int ret;
@ -580,7 +582,7 @@ int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *
if (!obj)
return -EIO;
ret = wmi_unmarshal_acpi_object(obj, out, 0);
ret = wmi_unmarshal_acpi_object(obj, out, min_size);
kfree(obj);
return ret;

7
drivers/platform/x86/intel/wmi/sbl-fw-update.c
View File

@ -28,15 +28,10 @@ static int get_fwu_request(struct device *dev, u32 *out)
__le32 *result;
int ret;
ret = wmidev_query_block(to_wmi_device(dev), 0, &buffer);
ret = wmidev_query_block(to_wmi_device(dev), 0, &buffer, sizeof(*result));
if (ret < 0)
return ret;
if (buffer.length < sizeof(*result)) {
kfree(buffer.data);
return -ENODATA;
}
result = buffer.data;
*out = le32_to_cpu(*result);
kfree(result);

2
drivers/platform/x86/wmi-bmof.c
View File

@ -62,7 +62,7 @@ static int wmi_bmof_probe(struct wmi_device *wdev, const void *context)
if (!buffer)
return -ENOMEM;
ret = wmidev_query_block(wdev, 0, buffer);
ret = wmidev_query_block(wdev, 0, buffer, 0);
if (ret < 0)
return ret;

3
include/linux/wmi.h
View File

@ -73,7 +73,8 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
int wmidev_invoke_procedure(struct wmi_device *wdev, u8 instance, u32 method_id,
const struct wmi_buffer *in);
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out);
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out,
size_t min_size);
int wmidev_set_block(struct wmi_device *wdev, u8 instance, const struct wmi_buffer *in);