Re: [PATCH 1/5] platform/x86: hp-wmi: validate WMI response header size

[Ilpo Järvinen]

On Thu, 16 Jul 2026, Emre Cecanpunar wrote:

> hp_wmi_perform_query() reads struct bios_return without checking that
> the firmware response buffer is large enough to contain it. A truncated
> response can therefore cause an out-of-bounds read.
> 
> Reject responses shorter than the mandatory header before accessing its
> fields or calculating the payload offset.
> 
> Fixes: 62ec30d45ecb ("misc: add HP WMI laptop extras driver")
> Signed-off-by: Emre Cecanpunar <emreleno@xxxxxxxxx>
> ---
>  drivers/platform/x86/hp/hp-wmi.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
> index 5353d997d272..205a6020e9c5 100644
> --- a/drivers/platform/x86/hp/hp-wmi.c
> +++ b/drivers/platform/x86/hp/hp-wmi.c
> @@ -670,6 +670,11 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
>  		ret = -EINVAL;
>  		goto out_free;
>  	}
> +	if (obj->buffer.length < sizeof(*bios_return)) {
> +		pr_warn("query 0x%x returned a short buffer\n", query);
> +		ret = -EINVAL;
> +		goto out_free;
> +	}

Hi,

This driver is using a deprecated WMI API. The new API might be able to do 
size checks for you so the correct course of action seems to modernize 
this driver instead.

IIRC, I have recently mentioned this same thing to somebody else so 
somebody might already be cooking a modernization patch.

-- 
 i.