[PATCH] platform/x86: hp-wmi: validate WMI return buffer length

[PATCH] platform/x86: hp-wmi: validate WMI return buffer length

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

hp_wmi_perform_query() casts the WMI return buffer to struct
bios_return without first checking that the buffer is large enough.
If firmware returns a buffer shorter than sizeof(struct bios_return),
the subsequent subtraction on buffer.length underflows, causing
memcpy to copy a near-maximal number of bytes and crash the kernel.

Add a buffer length check before accessing the return data, matching
the validation already present in the sibling hp-bioscfg driver.

Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 615b4cf6fc451..81c0acc874f8e 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -697,6 +697,13 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		goto out_free;
 	}
 
+	if (obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned undersized buffer (%u < %zu)\n",
+			query, obj->buffer.length, sizeof(*bios_return));
+		ret = -EINVAL;
+		goto out_free;
+	}
+
 	bios_return = (struct bios_return *)obj->buffer.pointer;
 	ret = bios_return->return_code;
 
-- 
2.47.3