[PATCH 1/5] platform/x86: hp-wmi: validate WMI response header size

[Emre Cecanpunar]

hp_wmi_perform_query() reads struct bios_return without checking that
the firmware response buffer is large enough to contain it. A truncated
response can therefore cause an out-of-bounds read.

Reject responses shorter than the mandatory header before accessing its
fields or calculating the payload offset.

Fixes: 62ec30d45ecb ("misc: add HP WMI laptop extras driver")
Signed-off-by: Emre Cecanpunar <emreleno@xxxxxxxxx>
---
 drivers/platform/x86/hp/hp-wmi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 5353d997d272..205a6020e9c5 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -670,6 +670,11 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		ret = -EINVAL;
 		goto out_free;
 	}
+	if (obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned a short buffer\n", query);
+		ret = -EINVAL;
+		goto out_free;
+	}
 
 	bios_return = (struct bios_return *)obj->buffer.pointer;
 	ret = bios_return->return_code;