From: Mario Limonciello <mario.limonciello@dell.com> To: Hans De Goede <hdegoede@redhat.com>, Mark Gross <mgross@linux.intel.com> Cc: LKML <linux-kernel@vger.kernel.org>, platform-driver-x86@vger.kernel.org, Mario Limonciello <mario.limonciello@dell.com> Subject: [PATCH] platform/x86: dell-wmi-sysman: fix a NULL pointer dereference Date: Fri, 29 Jan 2021 11:26:54 -0600 [thread overview] Message-ID: <20210129172654.2326751-1-mario.limonciello@dell.com> (raw) An upcoming Dell platform is causing a NULL pointer dereference in dell-wmi-sysman initialization. Validate that the input from BIOS matches correct ACPI types and abort module initialization if it fails. This leads to a memory leak that needs to be cleaned up properly. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com> --- drivers/platform/x86/dell-wmi-sysman/sysman.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell-wmi-sysman/sysman.c index dc6dd531c996..38b497991071 100644 --- a/drivers/platform/x86/dell-wmi-sysman/sysman.c +++ b/drivers/platform/x86/dell-wmi-sysman/sysman.c @@ -419,13 +419,19 @@ static int init_bios_attributes(int attr_type, const char *guid) return retval; /* need to use specific instance_id and guid combination to get right data */ obj = get_wmiobj_pointer(instance_id, guid); - if (!obj) + if (!obj || obj->type != ACPI_TYPE_PACKAGE) { + release_attributes_data(); return -ENODEV; + } elements = obj->package.elements; mutex_lock(&wmi_priv.mutex); while (elements) { /* sanity checking */ + if (elements[ATTR_NAME].type != ACPI_TYPE_STRING) { + pr_debug("incorrect element type\n"); + goto nextobj; + } if (strlen(elements[ATTR_NAME].string.pointer) == 0) { pr_debug("empty attribute found\n"); goto nextobj; -- 2.25.1
next reply other threads:[~2021-01-29 17:30 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-29 17:26 Mario Limonciello [this message] 2021-01-29 17:29 ` Limonciello, Mario 2021-01-30 3:55 ` Yuan, Perry 2021-01-30 21:43 ` Hans de Goede [not found] ` <SA1PR19MB49263EE7ECF0D06962BE00ECFAB79@SA1PR19MB4926.namprd19.prod.outlook.com> 2021-01-31 20:59 ` Hans de Goede 2021-02-01 2:36 ` Perry Yuan 2021-02-01 8:27 ` Hans de Goede
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210129172654.2326751-1-mario.limonciello@dell.com \ --to=mario.limonciello@dell.com \ --cc=hdegoede@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=mgross@linux.intel.com \ --cc=platform-driver-x86@vger.kernel.org \ --subject='Re: [PATCH] platform/x86: dell-wmi-sysman: fix a NULL pointer dereference' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).