From: Kurt Borja <kuurtb@gmail.com>
Date: Wed, 29 Apr 2026 13:20:56 +0000 (-0500)
Subject: platform/wmi: Fix unchecked min_size in wmidev_invoke_method()
X-Git-Tag: v7.1-rc3~28^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d3b7a868f1aeb6a43de880a3709ef3a0341f2c2a;p=thirdparty%2Fkernel%2Fstable.git

platform/wmi: Fix unchecked min_size in wmidev_invoke_method()

After calling wmidev_evaluate_method(), if the ACPI core does not return
an out object, then wmidev_invoke_method() bypasses the min_size check
and returns 0. Add a check for min_size if there is not an out object.

Fixes: 1aeded2f55f0 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260429-invoke-fix-v1-1-ce938eb80cd3@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
---

diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c
index 7aa40dab6145a..5a2ffcbab6af2 100644
--- a/drivers/platform/wmi/core.c
+++ b/drivers/platform/wmi/core.c
@@ -411,6 +411,9 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
 
 	obj = aout.pointer;
 	if (!obj) {
+		if (min_size != 0)
+			return -ENOMSG;
+
 		out->length = 0;
 		out->data = ZERO_SIZE_PTR;