github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 17:13:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/wmi: Extend wmidev_query_block() to reject undersized data

Browse Source 
WMI drivers using the buffer-based WMI API are expected to reject
undersized query results. Extend wmidev_query_block() to enable
the WMI driver core to perform this size check internally.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Armin Wolf 2026-04-06 22:32:36 +02:00 committed by Ilpo Järvinen
parent 96b1b053e1
commit 1aeded2f55
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
4 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/platform/wmi/core.c
View File

@ -565,13 +565,15 @@ EXPORT_SYMBOL_GPL(wmidev_block_query);
* @wdev: A wmi bus device from a driver * @wdev: A wmi bus device from a driver
* @instance: Instance index * @instance: Instance index
* @out: WMI buffer to fill * @out: WMI buffer to fill
* @min_size: Minimum size of the result data in bytes
* *
* Query a WMI data block, the caller must free the resulting data inside @out. * Query a WMI data block, the caller must free the resulting data inside @out
* Said data is guaranteed to be aligned on a 8-byte boundary. * using kfree(). Said data is guaranteed to be aligned on a 8-byte boundary.
* *
* Return: 0 on success or a negative error code on failure. * Return: 0 on success or a negative error code on failure.
*/ */
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out) int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out,
size_t min_size)
{ {
union acpi_object *obj; union acpi_object *obj;
int ret; int ret;
@ -580,7 +582,7 @@ int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *
if (!obj) if (!obj)
return -EIO; return -EIO;
ret = wmi_unmarshal_acpi_object(obj, out, 0); ret = wmi_unmarshal_acpi_object(obj, out, min_size);
kfree(obj); kfree(obj);
return ret; return ret;

7
drivers/platform/x86/intel/wmi/sbl-fw-update.c
View File

@ -28,15 +28,10 @@ static int get_fwu_request(struct device *dev, u32 *out)
__le32 *result; __le32 *result;
int ret; int ret;
ret = wmidev_query_block(to_wmi_device(dev), 0, &buffer); ret = wmidev_query_block(to_wmi_device(dev), 0, &buffer, sizeof(*result));
if (ret < 0) if (ret < 0)
return ret; return ret;
if (buffer.length < sizeof(*result)) {
kfree(buffer.data);
return -ENODATA;
}
result = buffer.data; result = buffer.data;
*out = le32_to_cpu(*result); *out = le32_to_cpu(*result);
kfree(result); kfree(result);

2
drivers/platform/x86/wmi-bmof.c
View File

@ -62,7 +62,7 @@ static int wmi_bmof_probe(struct wmi_device *wdev, const void *context)
if (!buffer) if (!buffer)
return -ENOMEM; return -ENOMEM;
ret = wmidev_query_block(wdev, 0, buffer); ret = wmidev_query_block(wdev, 0, buffer, 0);
if (ret < 0) if (ret < 0)
return ret; return ret;

3
include/linux/wmi.h
View File

@ -73,7 +73,8 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
int wmidev_invoke_procedure(struct wmi_device *wdev, u8 instance, u32 method_id, int wmidev_invoke_procedure(struct wmi_device *wdev, u8 instance, u32 method_id,
const struct wmi_buffer *in); const struct wmi_buffer *in);
int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out); int wmidev_query_block(struct wmi_device *wdev, u8 instance, struct wmi_buffer *out,
size_t min_size);
int wmidev_set_block(struct wmi_device *wdev, u8 instance, const struct wmi_buffer *in); int wmidev_set_block(struct wmi_device *wdev, u8 instance, const struct wmi_buffer *in);