]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
platform/wmi: Fix unchecked min_size in wmidev_invoke_method()
authorKurt Borja <kuurtb@gmail.com>
Wed, 29 Apr 2026 13:20:56 +0000 (08:20 -0500)
committerIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
Thu, 30 Apr 2026 12:33:32 +0000 (15:33 +0300)
After calling wmidev_evaluate_method(), if the ACPI core does not return
an out object, then wmidev_invoke_method() bypasses the min_size check
and returns 0. Add a check for min_size if there is not an out object.

Fixes: 1aeded2f55f0 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260429-invoke-fix-v1-1-ce938eb80cd3@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
drivers/platform/wmi/core.c

index 7aa40dab6145ab102c1b8b1c99e4dc42a16d4ed3..5a2ffcbab6af25acb6fc0e6c3b5c5169db2bf1e7 100644 (file)
@@ -411,6 +411,9 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
 
        obj = aout.pointer;
        if (!obj) {
+               if (min_size != 0)
+                       return -ENOMSG;
+
                out->length = 0;
                out->data = ZERO_SIZE_PTR;