Re: [PATCH v2] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

[Ilpo Järvinen]

On Wed, 26 Aug 2026 15:30:12 +0500, Muhammad Bilal wrote:

> hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
> struct bios_return header in the returned buffer. However, it only
> checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
> that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).
> 
> If the firmware or ACPI method returns a buffer shorter than 8 bytes:
> 
> [...]

Thank you for your contribution, it has been applied to my local
review-ilpo-next branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-next branch only once I've pushed my
local branch there, which might take a while.

FYI [if applicable to your patch], as per Linus' policy change, also
fixes are mostly routed through for-next unless the fix is for a
commit introduced in the most recent cycle or is clearly a regression
fix.

The list of commits applied:
[1/1] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()
      commit: c59252fa6260423ec3c4aa90b144fcad66851c76

--
 i.