[PATCH] platform/x86: acer-wmi: reject missing gaming WMI results

[PATCH] platform/x86: acer-wmi: reject missing gaming WMI results

[Yousef Alhouseen]

WMI_gaming_execute_u32_u64() returns success when firmware supplies
no output object, leaving the caller output untouched.  Gaming getters
then inspect an uninitialized result value.

Return -ENOMSG for a missing object and -EINVAL for a missing output
pointer, matching the existing malformed-result handling.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/platform/x86/acer-wmi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index e0eaaefb13d0..81d354c80cd2 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1581,7 +1581,11 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
 		return -EIO;
 
 	obj = result.pointer;
-	if (obj && out) {
+	if (!obj) {
+		ret = -ENOMSG;
+	} else if (!out) {
+		ret = -EINVAL;
+	} else {
 		switch (obj->type) {
 		case ACPI_TYPE_INTEGER:
 			*out = obj->integer.value;
-- 
2.54.0

Re: [PATCH] platform/x86: acer-wmi: reject missing gaming WMI results

[Armin Wolf]

Am 30.06.26 um 12:50 schrieb Yousef Alhouseen:

> WMI_gaming_execute_u32_u64() returns success when firmware supplies
> no output object, leaving the caller output untouched.  Gaming getters
> then inspect an uninitialized result value.
>
> Return -ENOMSG for a missing object and -EINVAL for a missing output
> pointer, matching the existing malformed-result handling.

Good catch, but i suspect that the original intention for checking "out"
was to enable callers to ignore any output values by passing "out" as NULL.

Please only return an error if obj is NULL _and_ out is not NULL.

Thanks,
Armin Wolf

> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---
>   drivers/platform/x86/acer-wmi.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
> index e0eaaefb13d0..81d354c80cd2 100644
> --- a/drivers/platform/x86/acer-wmi.c
> +++ b/drivers/platform/x86/acer-wmi.c
> @@ -1581,7 +1581,11 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
>   		return -EIO;
>   
>   	obj = result.pointer;
> -	if (obj && out) {
> +	if (!obj) {
> +		ret = -ENOMSG;
> +	} else if (!out) {
> +		ret = -EINVAL;
> +	} else {
>   		switch (obj->type) {
>   		case ACPI_TYPE_INTEGER:
>   			*out = obj->integer.value;

Re: [PATCH] platform/x86: acer-wmi: reject missing gaming WMI results

[Yousef Alhouseen]

Thanks, Armin. That interpretation makes sense. I’ll preserve NULL as
the output-ignore case and only reject a missing object when the
caller supplied an output pointer in v2.

On Tue, 30 Jun 2026 22:16:43 +0200, Armin Wolf <W_Armin@gmx.de> wrote:
> Am 30.06.26 um 12:50 schrieb Yousef Alhouseen:
>
> > WMI_gaming_execute_u32_u64() returns success when firmware supplies
> > no output object, leaving the caller output untouched. Gaming getters
> > then inspect an uninitialized result value.
> >
> > Return -ENOMSG for a missing object and -EINVAL for a missing output
> > pointer, matching the existing malformed-result handling.
>
> Good catch, but i suspect that the original intention for checking "out"
> was to enable callers to ignore any output values by passing "out" as NULL.
>
> Please only return an error if obj is NULL _and_ out is not NULL.
>
> Thanks,
> Armin Wolf
>
> > Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> > ---
> > drivers/platform/x86/acer-wmi.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
> > index e0eaaefb13d0..81d354c80cd2 100644
> > --- a/drivers/platform/x86/acer-wmi.c
> > +++ b/drivers/platform/x86/acer-wmi.c
> > @@ -1581,7 +1581,11 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
> > return -EIO;
> >
> > obj = result.pointer;
> > - if (obj && out) {
> > + if (!obj) {
> > + ret = -ENOMSG;
> > + } else if (!out) {
> > + ret = -EINVAL;
> > + } else {
> > switch (obj->type) {
> > case ACPI_TYPE_INTEGER:
> > *out = obj->integer.value;

[PATCH v2] platform/x86: acer-wmi: reject missing gaming WMI results

[Yousef Alhouseen]

WMI_gaming_execute_u32_u64() returns success when firmware supplies
no output object, leaving the caller output untouched. Gaming getters
then inspect an uninitialized result value.

When the caller requests an output value, return -ENOMSG if firmware
supplies no object. Preserve a NULL output pointer as the supported way
for callers to ignore the result.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
Changes in v2:
- Preserve NULL as the supported output-ignore case.
- Only reject a missing firmware object when output was requested.

 drivers/platform/x86/acer-wmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index e0eaaefb13d0..61ae622c93d9 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1581,7 +1581,9 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
 		return -EIO;
 
 	obj = result.pointer;
-	if (obj && out) {
+	if (!obj && out) {
+		ret = -ENOMSG;
+	} else if (obj && out) {
 		switch (obj->type) {
 		case ACPI_TYPE_INTEGER:
 			*out = obj->integer.value;
-- 
2.55.0

Re: [PATCH v2] platform/x86: acer-wmi: reject missing gaming WMI results

[Ilpo Järvinen]

On Tue, 30 Jun 2026, Yousef Alhouseen wrote:

> WMI_gaming_execute_u32_u64() returns success when firmware supplies
> no output object, leaving the caller output untouched. Gaming getters
> then inspect an uninitialized result value.
> 
> When the caller requests an output value, return -ENOMSG if firmware
> supplies no object. Preserve a NULL output pointer as the supported way
> for callers to ignore the result.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>

Should this have a Fixes tag?

> ---
> Changes in v2:
> - Preserve NULL as the supported output-ignore case.
> - Only reject a missing firmware object when output was requested.
> 
>  drivers/platform/x86/acer-wmi.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
> index e0eaaefb13d0..61ae622c93d9 100644
> --- a/drivers/platform/x86/acer-wmi.c
> +++ b/drivers/platform/x86/acer-wmi.c
> @@ -1581,7 +1581,9 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
>  		return -EIO;
>  
>  	obj = result.pointer;
> -	if (obj && out) {
> +	if (!obj && out) {
> +		ret = -ENOMSG;
> +	} else if (obj && out) {
>  		switch (obj->type) {
>  		case ACPI_TYPE_INTEGER:
>  			*out = obj->integer.value;
> 

-- 
 i.

[PATCH v3] platform/x86: acer-wmi: reject missing gaming WMI results

[Yousef Alhouseen]

WMI_gaming_execute_u32_u64() returns success when firmware supplies
no output object, leaving the caller output untouched. Gaming getters
then inspect an uninitialized result value.

When the caller requests an output value, return -ENOMSG if firmware
supplies no object. Preserve a NULL output pointer as the supported way
for callers to ignore the result.

Fixes: 2d76708c2221 ("platform/x86: acer-wmi: use WMI calls for platform profile handling")
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
Changes in v3:
- Add the Fixes tag requested by Ilpo Järvinen.

Changes in v2:
- Preserve NULL as the supported output-ignore case.
- Only reject a missing firmware object when output was requested.

 drivers/platform/x86/acer-wmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index e0eaaefb13d0..61ae622c93d9 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1581,7 +1581,9 @@ static int WMI_gaming_execute_u32_u64(u32 method_id, u32 in, u64 *out)
 		return -EIO;
 
 	obj = result.pointer;
-	if (obj && out) {
+	if (!obj && out) {
+		ret = -ENOMSG;
+	} else if (obj && out) {
 		switch (obj->type) {
 		case ACPI_TYPE_INTEGER:
 			*out = obj->integer.value;
-- 
2.55.0