After calling wmidev_evaluate_method(), if the ACPI core does not return
an out object, then wmidev_invoke_method() bypasses the min_size check
and returns 0. Add a check for min_size if there is not an out object.
Fixes: 1aeded2f55 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260429-invoke-fix-v1-1-ce938eb80cd3@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Highlights:
- asus-wmi:
- Retain battery charge threshold during boot which avoids unsolicited
change to 100%. Return -ENODATA when the limit is not yet known
- Improve screenpad power/brightness handling consistency
- Fix screenpad brightness range
- barco-p50-gpio: Normalize gpio_get return values
- bitland-mifs-wmi: Add driver for Bitland laptops (supports platform
profile,hwmon, kbd backlight, gpu mode, hotkeys, and
fan boost)
- dell_rbu: Fix using uninitialized value in sysfs write function
- dell-wmi-sysman: Respect destination length when constructing enum
strings
- hp-wmi:
- Propagate fan setting apply failures and log an error
- Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock
- Correct keepalive schedule_delayed_work() to mod_delayed_work()
- Fix u8 underflows in GPU delta calculation
- Use mutex to protect fan pwm/mode
- Ignore kbd backlight and FnLock key events that are handled by FW
- Fix fan table parsing (use correct field)
- Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and Omen MAX
16-ak0xxxx
- input: trackpoint & thinkpad_acpi: Enable doubletap by default and
add sysfs enable/disable
- int3472: Add support for GPIO type 0x02 (IR flood LED)
- intel-speed-select: (updated to v1.26)
- Avoid using current base frequency as maximum
- Fix CPU extended family ID decoding
- Fix exit code
- Improve error reporting
- intel/vsec: Refactor to support ACPI-enumerated PMT endpoints.
- pcengines-apuv2: Attach software node to the gpiochip
- uniwill:
- Refactor hwmon to smaller parts to accomodate HW diversity
- Support USB-C power/performance priority switch through sysfs
- Add another XMG Fusion 15 (L19) DMI vendor
- Enable fine-grained features to device lineup mapping
- wmi: Perform output size check within WMI core to allow simpler WMI
drivers
- acpi_driver -> platform driver conversions (a large number of changes
from Rafael J. Wysocki)
- Miscellaneous cleanups / refactoring / improvements
The following is an automated shortlog grouped by driver:
acer-wireless:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
asus-laptop:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
asus-wireless:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
asus-wmi:
- adjust screenpad power/brightness handling
- do not enforce a battery charge threshold
- fix screenpad brightness range
barco-p50-gpio:
- convert to guard() notation
- normalize return value of gpio_get
bitland-mifs-wmi:
- Add new Bitland MIFS WMI driver
dell/dell-rbtn:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
dell_rbu:
- avoid uninit value usage in packet_size_write()
dell-wmi-sysman:
- bound enumeration string aggregation
- Clean up security buffer helpers
- Fix typo in function comment
- Use standard kobj_sysfs_ops
- Use sysfs_emit{_at} in show functions
Documentation: laptops:
- Update documentation for uniwill laptops
Documentation:
- thinkpad-acpi - Document doubletap_enable attribute
eeepc-laptop:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
fujitsu:
- Convert backlight driver to a platform one
- Convert laptop driver to a platform one
- Register ACPI notify handlers directly
- Reorder code to avoid forward declarations
fujitsu-tablet:
- Convert ACPI driver to a platform one
hp-wmi:
- add locking for concurrent hwmon access
- add Omen 14-fb0xxx (board 8C58) support
- Add support for Omen 16-n0xxx (8A44)
- Add support for Omen 16-wf1xxx (8C77)
- Add support for OMEN MAX 16-ak0xxx (8D87)
- avoid cancel_delayed_work_sync from work handler
- fix fan table parsing
- fix ignored return values in fan settings
- fix u8 underflow in gpu_delta calculation
- Ignore backlight and FnLock events
- use mod_delayed_work to reset keep-alive timer
input:
- trackpoint - Enable doubletap by default on capable devices
int3472:
- Add support for GPIO type 0x02 (IR flood LED)
- Parameterize LED con_id in registration
- Rename pled to led in LED registration code
- Use local variable for LED struct access
intel/rst:
- Convert ACPI driver to a platform one
intel/smartconnect:
- Convert ACPI driver to a platform one
intel/tpmi:
- Use 32 bit aligned address for debugfs mem write
intel/vsec:
- Decouple add/link helpers from PCI
- Make driver_data info const
- Plumb ACPI PMT discovery tables through vsec
- Refactor base_addr handling
- Return real error codes from registration path
- Switch exported helpers from pci_dev to device
lg-laptop:
- Convert ACPI driver to a platform one
- Drop debug-only ACPI notify handler
nvsw-sn2201:
- Drop unused include
panasonic-laptop:
- Convert ACPI driver to a platform one
- Fix OPTD notifier registration and cleanup
- Make pcc_register_optd_notifier() void
- Register ACPI notify handler directly
- Remove redundant checks from 3 functions
pcengines-apuv2:
- attach software node to the gpiochip
sony-laptop:
- Convert NC driver to a platform one
- Convert PIC driver to a platform one
- Register ACPI notify handler directly
surface: hotplug:
- Correct inclusion for GPIO APIs
surface: surfacepro3_button:
- Convert to a platform driver
- Drop wakeup source on remove
- Register ACPI notify handler
system76:
- Convert ACPI driver to a platform one
- Drop redundant devm_led_classdev_unregister()
- Register ACPI notify handler directly
thinkpad_acpi:
- Add sysfs control for TrackPoint double-tap
- Drop ACPI driver registration
- remove obsolete TODO comment
- use seq_puts() instead of seq_printf()
tools/power/x86/intel-speed-select:
- Avoid current base freq as maximum
- Fix cpu extended family ID decoding
- Fix output when running on unsupported CLX platforms
- Fix some program return value
- Print Version info when Incompatible API version is detected
- v1.26 release
topstar-laptop:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
toshiba_acpi:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
- Reorder code to avoid forward declaration
toshiba_bluetooth:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
toshiba_haps:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
uniwill-laptop:
- Apply features across all TUXEDO devices
- Fix signedness bug
- Fix XMG Fusion 15 (L19) entries
- Implement USB-C power priority setting
- Rework hwmon feature defines
wireless-hotkey:
- Convert ACPI driver to a platform one
- Register ACPI notify handler directly
wmi:
- Add wmidev_invoke_procedure()
- Convert drivers to use wmidev_invoke_procedure()
- Extend wmidev_invoke_method() to reject undersized data
- Extend wmidev_query_block() to reject undersized data
- Prepare to reject undersized unmarshalling results
- Replace .no_notify_data with .min_event_size
x86:
- remove unnecessary module_init/exit() functions
Merges:
- Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into review-ilpo-next
- Merge tag 'fixes' into 'for-next'
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaeYxSwAKCRBZrE9hU+XO
MRzTAQCPUKVOpSY/cjtPXVBn0uJbAo1MSvytv00Kv7dcatvrrwEA9lqmwOfl0kzr
CowEVVCD3om++W9vOsL65hachbAl1QA=
=1qkw
-----END PGP SIGNATURE-----
Merge tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen:
"asus-wmi:
- Retain battery charge threshold during boot which avoids
unsolicited change to 100%. Return -ENODATA when the limit
is not yet known
- Improve screenpad power/brightness handling consistency
- Fix screenpad brightness range
barco-p50-gpio:
- Normalize gpio_get return values
bitland-mifs-wmi:
- Add driver for Bitland laptops (supports platform profile,
hwmon, kbd backlight, gpu mode, hotkeys, and fan boost)
dell_rbu:
- Fix using uninitialized value in sysfs write function
dell-wmi-sysman:
- Respect destination length when constructing enum strings
hp-wmi:
- Propagate fan setting apply failures and log an error
- Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock
- Correct keepalive schedule_delayed_work() to mod_delayed_work()
- Fix u8 underflows in GPU delta calculation
- Use mutex to protect fan pwm/mode
- Ignore kbd backlight and FnLock key events that are handled by FW
- Fix fan table parsing (use correct field)
- Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and
Omen MAX 16-ak0xxxx
input: trackpoint & thinkpad_acpi:
- Enable doubletap by default and add sysfs enable/disable
int3472:
- Add support for GPIO type 0x02 (IR flood LED)
intel-speed-select: (updated to v1.26)
- Avoid using current base frequency as maximum
- Fix CPU extended family ID decoding
- Fix exit code
- Improve error reporting
intel/vsec:
- Refactor to support ACPI-enumerated PMT endpoints.
pcengines-apuv2:
- Attach software node to the gpiochip
uniwill:
- Refactor hwmon to smaller parts to accomodate HW diversity
- Support USB-C power/performance priority switch through sysfs
- Add another XMG Fusion 15 (L19) DMI vendor
- Enable fine-grained features to device lineup mapping
wmi:
- Perform output size check within WMI core to allow simpler WMI
drivers
misc:
- acpi_driver -> platform driver conversions (a large number of
changes from Rafael J. Wysocki)
- cleanups / refactoring / improvements"
* tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (106 commits)
platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77)
platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44)
platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87)
platform/x86: hp-wmi: fix fan table parsing
platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support
platform/wmi: Replace .no_notify_data with .min_event_size
platform/wmi: Extend wmidev_query_block() to reject undersized data
platform/wmi: Extend wmidev_invoke_method() to reject undersized data
platform/wmi: Prepare to reject undersized unmarshalling results
platform/wmi: Convert drivers to use wmidev_invoke_procedure()
platform/wmi: Add wmidev_invoke_procedure()
platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED)
platform/x86: int3472: Parameterize LED con_id in registration
platform/x86: int3472: Rename pled to led in LED registration code
platform/x86: int3472: Use local variable for LED struct access
platform/x86: thinkpad_acpi: remove obsolete TODO comment
platform/x86: dell-wmi-sysman: bound enumeration string aggregation
platform/x86: hp-wmi: Ignore backlight and FnLock events
platform/x86: uniwill-laptop: Fix signedness bug
platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
...
WMI drivers using the buffer-based WMI API are expected to reject
undersized event payloads. Extend the WMI driver core to allow
such drivers to specify their minimum supported event payload size.
Also remove the now redundant .no_notify_data field.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-7-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
WMI drivers using the buffer-based WMI API are expected to reject
undersized query results. Extend wmidev_query_block() to enable
the WMI driver core to perform this size check internally.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
WMI drivers using the buffer-based WMI API are expected to reject
undersized method return values. Extend wmidev_invoke_method() to
enable the WMI driver core to perform this size check internally.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Driver using the buffer-based WMI API usually reject buffers resulting
from WMI method calls or block queries if they contain not enough data.
Prepare the WMI core for assisting in this by automatically rejecting
undersized unmarshalling results.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Some WMI methods return no values, so the whole postprocessing
of the result data is not needed for them. Add a special function
for calling such WMI methods to prepare for future changes of
the main wmidev_invoke_method() function.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes: 12046f8c77 ("platform/x86: wmi: Add driver_override support")
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260324005919.2408620-7-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
This was done entirely with mindless brute force, using
git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'
to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.
Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.
For the same reason the 'flex' versions will be done as a separate
conversion.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:
Single allocations: kmalloc(sizeof(TYPE), ...)
are replaced with: kmalloc_obj(TYPE, ...)
Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with: kmalloc_objs(TYPE, COUNT, ...)
Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...)
(where TYPE may also be *VAR)
The resulting allocations no longer return "void *", instead returning
"TYPE *".
Signed-off-by: Kees Cook <kees@kernel.org>
The Windows WMI-ACPI driver likely uses wmilib [1] to interact with
the WMI service in userspace. Said library uses plain byte buffers
for exchanging data, so the WMI-ACPI driver has to convert between
those byte buffers and ACPI objects returned by the ACPI firmware.
The format of the byte buffer is publicly documented [2], and after
some reverse eingineering of the WMI-ACPI driver using a set of custom
ACPI tables, the following conversion rules have been discovered:
- ACPI integers are always converted into a uint32
- ACPI strings are converted into special WMI strings
- ACPI buffers are copied as-is
- ACPI packages are unpacked
Extend the ACPI-WMI driver to also perform this kind of marshalling
for WMI data blocks, methods and events. Doing so gives us a number
of benefits:
- WMI drivers are not restricted to a fixed set of supported ACPI data
types anymore, see dell-wmi-aio (integer vs buffer) and
hp-wmi-sensors (string vs buffer)
- correct marshalling of WMI strings when data blocks are marked
as requiring ACPI strings instead of ACPI buffers
- development of WMI drivers without having to understand ACPI
This eventually should result in better compatibility with some
ACPI firmware implementations and in simpler WMI drivers. There are
however some differences between the original Windows driver and
the ACPI-WMI driver when it comes to ACPI object conversions:
- the Windows driver copies internal _ACPI_METHOD_ARGUMENT_V1 data
structures into the output buffer when encountering nested ACPI
packages. This is very likely an error inside the driver itself, so
we do not support nested ACPI packages.
- when converting WMI strings (UTF-16LE) into ACPI strings (ASCII),
the Windows driver replaces non-ascii characters (ä -> a, & -> ?)
instead of returning an error. This behavior is not documented
anywhere and might lead to severe errors in some cases (like
setting BIOS passwords over WMI), so we simply return an error.
As the current bus-based WMI API is based on ACPI buffers, a new
API is necessary. The legacy GUID-based WMI API is not extended to
support marshalling, as WMI drivers using said API are expected to
move to the bus-based WMI API in the future.
[1] https://learn.microsoft.com/de-de/windows-hardware/drivers/ddi/wmilib/
[2] https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/
driver-defined-wmi-data-items
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260116204116.4030-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Move the WMI core code into a separate directory to prepare for
future additions to the WMI driver. Also update the description
of the Kconfig entry to better fit with the other subsystem
Kconfig entries.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20251111131125.3379-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
