From: Hans de Goede <hdegoede@redhat.com>
To: Mark Gross <mgross@linux.intel.com>,
Andy Shevchenko <andy@infradead.org>
Cc: Hans de Goede <hdegoede@redhat.com>,
Mario Limonciello <mario.limonciello@dell.com>,
Divya Bharathi <Divya_Bharathi@dell.com>,
Alexander Naumann <alexandernaumann@gmx.de>,
platform-driver-x86@vger.kernel.org
Subject: [PATCH 6/7] platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust
Date: Sat, 20 Mar 2021 15:34:28 +0100 [thread overview]
Message-ID: <20210320143429.76047-7-hdegoede@redhat.com> (raw)
In-Reply-To: <20210320143429.76047-1-hdegoede@redhat.com>
Make init_bios_attributes() ACPI object parsing more robust:
1. Always check that the type of the return ACPI object is package, rather
then only checking this for instance_id == 0
2. Check that the package has the minimum amount of elements which will
be consumed by the populate_foo_data() for the attr_type
3. Don't return -ENODEV when the get_wmiobj_pointer() call for
instance_id == 0 returns NULL. It is possible for a BIOS to e.g.
only have ENUM + INT attributes and no STR attributes
Note/TODO: The populate_foo_data() functions should also be made more
robust. The should check the type of each of the elements matches the
type which they expect and in case of populate_enum_data()
obj->package.count should be passed to it as an argument and it should
re-check this itself since it consume a variable number of elements.
Cc: Divya Bharathi <Divya_Bharathi@dell.com>
Cc: Mario Limonciello <mario.limonciello@dell.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
.../x86/dell/dell-wmi-sysman/sysman.c | 34 +++++++++++++++----
1 file changed, 28 insertions(+), 6 deletions(-)
diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
index 6ed3cee2208b..c2ccf86f4037 100644
--- a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
+++ b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
@@ -400,6 +400,7 @@ static int init_bios_attributes(int attr_type, const char *guid)
union acpi_object *obj = NULL;
union acpi_object *elements;
struct kset *tmp_set;
+ int min_elements;
/* instance_id needs to be reset for each type GUID
* also, instance IDs are unique within GUID but not across
@@ -410,14 +411,36 @@ static int init_bios_attributes(int attr_type, const char *guid)
retval = alloc_attributes_data(attr_type);
if (retval)
return retval;
+
+ switch (attr_type) {
+ case ENUM: min_elements = 8; break;
+ case INT: min_elements = 9; break;
+ case STR: min_elements = 8; break;
+ case PO: min_elements = 4; break;
+ default:
+ pr_err("Error: Unknown attr_type: %d\n", attr_type);
+ return -EINVAL;
+ }
+
+ mutex_lock(&wmi_priv.mutex);
+
/* need to use specific instance_id and guid combination to get right data */
obj = get_wmiobj_pointer(instance_id, guid);
- if (!obj || obj->type != ACPI_TYPE_PACKAGE)
- return -ENODEV;
- elements = obj->package.elements;
+ while (obj) {
+ if (obj->type != ACPI_TYPE_PACKAGE) {
+ pr_err("Error: Expected ACPI-package type, got: %d\n", obj->type);
+ retval = -EIO;
+ goto err_attr_init;
+ }
+
+ if (obj->package.count < min_elements) {
+ pr_err("Error: ACPI-package does not have enough elements: %d < %d\n",
+ obj->package.count, min_elements);
+ goto nextobj;
+ }
+
+ elements = obj->package.elements;
- mutex_lock(&wmi_priv.mutex);
- while (elements) {
/* sanity checking */
if (elements[ATTR_NAME].type != ACPI_TYPE_STRING) {
pr_debug("incorrect element type\n");
@@ -482,7 +505,6 @@ static int init_bios_attributes(int attr_type, const char *guid)
kfree(obj);
instance_id++;
obj = get_wmiobj_pointer(instance_id, guid);
- elements = obj ? obj->package.elements : NULL;
}
mutex_unlock(&wmi_priv.mutex);
--
2.30.2
next prev parent reply other threads:[~2021-03-20 14:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-20 14:34 [PATCH 0/7] platform/x86: dell-wmi-sysman: Various error-handling and robustness fixes Hans de Goede
2021-03-20 14:34 ` [PATCH 1/7] platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit Hans de Goede
2021-03-20 14:34 ` [PATCH 2/7] platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times Hans de Goede
2021-03-20 14:34 ` [PATCH 3/7] platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure Hans de Goede
2021-03-20 14:34 ` [PATCH 4/7] platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling Hans de Goede
2021-03-20 14:34 ` [PATCH 5/7] platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found Hans de Goede
2021-03-20 14:34 ` Hans de Goede [this message]
2021-03-20 14:34 ` [PATCH 7/7] platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() Hans de Goede
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210320143429.76047-7-hdegoede@redhat.com \
--to=hdegoede@redhat.com \
--cc=Divya_Bharathi@dell.com \
--cc=alexandernaumann@gmx.de \
--cc=andy@infradead.org \
--cc=mario.limonciello@dell.com \
--cc=mgross@linux.intel.com \
--cc=platform-driver-x86@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).