[PATCH] platform/x86: lg-laptop: check WMBB buffer length

[Kang Chen]

Two WMBB users read byte 0x10 of the returned buffer after checking only
the object type.  A short buffer from the firmware makes both
usb_charge_show() and charge_control_end_threshold_show() read past the
allocation.

Add a named offset and require the buffer to be long enough before
reading the status byte.

Fixes: dbf0c5a6b1f8 ("platform/x86: Add LG Gram laptop special features driver")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/platform/x86/lg-laptop.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
index 36ad1e269443..4e1dbd80ffa1 100644
--- a/drivers/platform/x86/lg-laptop.c
+++ b/drivers/platform/x86/lg-laptop.c
@@ -87,6 +87,7 @@ MODULE_PARM_DESC(fw_debug, "Enable printing of firmware debug messages");
 #define WM_FAN_MODE	0x33
 #define WMBB_USB_CHARGE 0x10B
 #define WMBB_BATT_LIMIT 0x10C
+#define WMBB_STATUS_OFFSET 0x10
 
 #define KBD_LED_BRIGHTNESS_MASK GENMASK(4, 0)
 #define KBD_LED_BRIGHTNESS_OFF	0x0
@@ -405,12 +406,13 @@ static ssize_t usb_charge_show(struct device *dev,
 	if (!r)
 		return -EIO;
 
-	if (r->type != ACPI_TYPE_BUFFER) {
+	if (r->type != ACPI_TYPE_BUFFER ||
+	    r->buffer.length <= WMBB_STATUS_OFFSET) {
 		kfree(r);
 		return -EIO;
 	}
 
-	status = !!r->buffer.pointer[0x10];
+	status = !!r->buffer.pointer[WMBB_STATUS_OFFSET];
 
 	kfree(r);
 
@@ -524,12 +526,13 @@ static ssize_t charge_control_end_threshold_show(struct device *device,
 		if (!r)
 			return -EIO;
 
-		if (r->type != ACPI_TYPE_BUFFER) {
+		if (r->type != ACPI_TYPE_BUFFER ||
+		    r->buffer.length <= WMBB_STATUS_OFFSET) {
 			kfree(r);
 			return -EIO;
 		}
 
-		status = r->buffer.pointer[0x10];
+		status = r->buffer.pointer[WMBB_STATUS_OFFSET];
 		kfree(r);
 	} else {
 		ret = lg_wmab_get(&pf_device->dev, WM_BATT_LIMIT, &status);
-- 
2.34.1