[PATCH 1/2] platform/x86/amd/hsmp: Validate num_args before the fd-mode gate in hsmp_ioctl_msg()

[Muralidhara M K]

is_get_msg() reads msg.args[0]'s CHECK_GET_BIT to tell GET and SET apart
for HSMP_SET_GET messages, but hsmp_ioctl_msg() calls it before
validate_message() (reached later through hsmp_send_message()) checks
that msg.num_args matches desc->num_args. A request with num_args = 0
for such a message reaches is_get_msg() anyway, so args[0] is read even
though the request does not carry it.

Check msg.num_args against desc->num_args before the fd-mode switch, so
a num_args mismatch is rejected with -EINVAL before is_get_msg() reads
args[0], rather than surfacing as -EPERM from the fd-mode gate.

Reported-by: Sashiko <sashiko-reviews@xxxxxxxxxxxxxxx>
Link: https://sashiko.dev/#/patchset/20261012085407.1202295-1-muralidhara.mk@xxxxxxx
Signed-off-by: Muralidhara M K <muralidhara.mk@xxxxxxx>
---
 drivers/platform/x86/amd/hsmp/hsmp.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/platform/x86/amd/hsmp/hsmp.c b/drivers/platform/x86/amd/hsmp/hsmp.c
index 45d20beda946..635e6d5723ac 100644
--- a/drivers/platform/x86/amd/hsmp/hsmp.c
+++ b/drivers/platform/x86/amd/hsmp/hsmp.c
@@ -485,6 +485,16 @@ static long hsmp_ioctl_msg(struct file *fp, unsigned long arg)
 		if (!desc)
 			return -ENOMSG;
 
+		/*
+		 * is_get_msg() below reads msg.args[0] for HSMP_SET_GET
+		 * messages. Reject a num_args mismatch here first, so a
+		 * malformed request fails with -EINVAL instead of letting
+		 * the fd-mode gate read an argument slot the request does
+		 * not actually carry.
+		 */
+		if (msg.num_args != desc->num_args)
+			return -EINVAL;
+
 		switch (fp->f_mode & (FMODE_WRITE | FMODE_READ)) {
 		case FMODE_WRITE:
 			/*
-- 
2.34.1