[PATCH] platform/x86: hp-wmi: validate WMI return buffer length

[PATCH] platform/x86: hp-wmi: validate WMI return buffer length

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

hp_wmi_perform_query() casts the WMI return buffer to struct
bios_return without first checking that the buffer is large enough.
If firmware returns a buffer shorter than sizeof(struct bios_return),
the subsequent subtraction on buffer.length underflows, causing
memcpy to copy a near-maximal number of bytes and crash the kernel.

Add a buffer length check before accessing the return data, matching
the validation already present in the sibling hp-bioscfg driver.

Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 615b4cf6fc451..81c0acc874f8e 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -697,6 +697,13 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		goto out_free;
 	}
 
+	if (obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned undersized buffer (%u < %zu)\n",
+			query, obj->buffer.length, sizeof(*bios_return));
+		ret = -EINVAL;
+		goto out_free;
+	}
+
 	bios_return = (struct bios_return *)obj->buffer.pointer;
 	ret = bios_return->return_code;
 
-- 
2.47.3

Re: [PATCH] platform/x86: hp-wmi: validate WMI return buffer length

[Ilpo Järvinen]

On Sat, 24 Oct 2026, Tristan Madani wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> hp_wmi_perform_query() casts the WMI return buffer to struct
> bios_return without first checking that the buffer is large enough.
> If firmware returns a buffer shorter than sizeof(struct bios_return),
> the subsequent subtraction on buffer.length underflows, causing
> memcpy to copy a near-maximal number of bytes and crash the kernel.

Where's the crash output then? Please quote it in the changelog for the 
relevant parts.

> Add a buffer length check before accessing the return data, matching
> the validation already present in the sibling hp-bioscfg driver.

More important though, hp-wmi should migrate to using the modern WMI API 
which would likely allow using WMI core to validate the output sizes.

Somebody tried the WMI conversion earlier but to me that patch looked 
incorrect (or more like clearly missing pieces) and I had bad experiences 
with the particular submitter when it comes to converging to something 
sensible based on given feedback so I've low prioritized that patch.

> Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/platform/x86/hp/hp-wmi.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
> index 615b4cf6fc451..81c0acc874f8e 100644
> --- a/drivers/platform/x86/hp/hp-wmi.c
> +++ b/drivers/platform/x86/hp/hp-wmi.c
> @@ -697,6 +697,13 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
>  		goto out_free;
>  	}
>  
> +	if (obj->buffer.length < sizeof(*bios_return)) {
> +		pr_warn("query 0x%x returned undersized buffer (%u < %zu)\n",
> +			query, obj->buffer.length, sizeof(*bios_return));
> +		ret = -EINVAL;
> +		goto out_free;
> +	}
> +
>  	bios_return = (struct bios_return *)obj->buffer.pointer;
>  	ret = bios_return->return_code;
>  
> 

-- 
 i.