platform/wmi: Prepare to reject undersized unmarshalling results

Driver using the buffer-based WMI API usually reject buffers resulting
from WMI method calls or block queries if they contain not enough data.
Prepare the WMI core for assisting in this by automatically rejecting
undersized unmarshalling results.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

authored by

Armin Wolf and committed by

Ilpo Järvinen 3 weeks ago 204b52fa 578bc2a5

+32 -7

4 changed files

expand all

drivers

platform

wmi

core.c

internal.h

marshalling.c

tests

marshalling_kunit.c

+3 -3

drivers/platform/wmi/core.c

··· 420 420 return 0; 421 421 } 422 422 423 - ret = wmi_unmarshal_acpi_object(obj, out); 423 + ret = wmi_unmarshal_acpi_object(obj, out, 0); 424 424 kfree(obj); 425 425 426 426 return ret; ··· 583 583 if (!obj) 584 584 return -EIO; 585 585 586 - ret = wmi_unmarshal_acpi_object(obj, out); 586 + ret = wmi_unmarshal_acpi_object(obj, out, 0); 587 587 kfree(obj); 588 588 589 589 return ret; ··· 1416 1416 return; 1417 1417 } 1418 1418 1419 - ret = wmi_unmarshal_acpi_object(obj, &buffer); 1419 + ret = wmi_unmarshal_acpi_object(obj, &buffer, 0); 1420 1420 if (ret < 0) { 1421 1421 dev_warn(&wblock->dev.dev, "Failed to unmarshal event data: %d\n", ret); 1422 1422 return;

+2 -1

drivers/platform/wmi/internal.h

··· 11 11 union acpi_object; 12 12 struct wmi_buffer; 13 13 14 - int wmi_unmarshal_acpi_object(const union acpi_object *obj, struct wmi_buffer *buffer); 14 + int wmi_unmarshal_acpi_object(const union acpi_object *obj, struct wmi_buffer *buffer, 15 + size_t min_size); 15 16 int wmi_marshal_string(const struct wmi_buffer *buffer, struct acpi_buffer *out); 16 17 17 18 #endif /* _WMI_INTERNAL_H_ */

+5 -1

drivers/platform/wmi/marshalling.c

··· 151 151 return 0; 152 152 } 153 153 154 - int wmi_unmarshal_acpi_object(const union acpi_object *obj, struct wmi_buffer *buffer) 154 + int wmi_unmarshal_acpi_object(const union acpi_object *obj, struct wmi_buffer *buffer, 155 + size_t min_size) 155 156 { 156 157 size_t length, alloc_length; 157 158 u8 *data; ··· 161 160 ret = wmi_obj_get_buffer_length(obj, &length); 162 161 if (ret < 0) 163 162 return ret; 163 + 164 + if (length < min_size) 165 + return -ENODATA; 164 166 165 167 if (ARCH_KMALLOC_MINALIGN < 8) { 166 168 /*

+22 -2

drivers/platform/wmi/tests/marshalling_kunit.c

··· 372 372 struct wmi_buffer result; 373 373 int ret; 374 374 375 - ret = wmi_unmarshal_acpi_object(&param->obj, &result); 375 + ret = wmi_unmarshal_acpi_object(&param->obj, &result, param->buffer.length); 376 376 if (ret < 0) 377 377 KUNIT_FAIL_AND_ABORT(test, "Unmarshalling of ACPI object failed\n"); 378 378 ··· 389 389 struct wmi_buffer result; 390 390 int ret; 391 391 392 - ret = wmi_unmarshal_acpi_object(&param->obj, &result); 392 + ret = wmi_unmarshal_acpi_object(&param->obj, &result, 0); 393 393 if (ret < 0) 394 394 return; 395 395 ··· 427 427 KUNIT_FAIL(test, "Invalid string was not rejected\n"); 428 428 } 429 429 430 + static void wmi_unmarshal_acpi_object_undersized_test(struct kunit *test) 431 + { 432 + const union acpi_object obj = { 433 + .integer = { 434 + .type = ACPI_TYPE_INTEGER, 435 + .value = 0xdeadbeef, 436 + }, 437 + }; 438 + struct wmi_buffer result; 439 + int ret; 440 + 441 + ret = wmi_unmarshal_acpi_object(&obj, &result, sizeof(expected_single_integer) + 1); 442 + if (ret < 0) 443 + return; 444 + 445 + kfree(result.data); 446 + KUNIT_FAIL(test, "Undersized unmarshalling result was not rejected\n"); 447 + } 448 + 430 449 static struct kunit_case wmi_marshalling_test_cases[] = { 431 450 KUNIT_CASE_PARAM(wmi_unmarshal_acpi_object_test, 432 451 wmi_unmarshal_acpi_object_gen_params), ··· 455 436 wmi_unmarshal_acpi_object_failure_gen_params), 456 437 KUNIT_CASE_PARAM(wmi_marshal_string_failure_test, 457 438 wmi_marshal_string_failure_gen_params), 439 + KUNIT_CASE(wmi_unmarshal_acpi_object_undersized_test), 458 440 {} 459 441 }; 460 442

Configure Feed

Configure Feed