diff options
| author | Kurt Borja <[email protected]> | 2025-06-30 03:43:12 +0000 |
|---|---|---|
| committer | Ilpo Järvinen <[email protected]> | 2025-06-30 08:36:52 +0000 |
| commit | eb617dd25ca176f3fee24f873f0fd60010773d67 (patch) | |
| tree | 8143ce56a3775378aeee0817e1715b511c0e23f6 /drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c | |
| parent | platform/x86: wmi: Update documentation of WCxx/WExx ACPI methods (diff) | |
| download | kernel-eb617dd25ca176f3fee24f873f0fd60010773d67.tar.gz kernel-eb617dd25ca176f3fee24f873f0fd60010773d67.zip | |
platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
After retrieving WMI data blocks in sysfs callbacks, check for the
validity of them before dereferencing their content.
Reported-by: Jan Graczyk <[email protected]>
Closes: https://lore.kernel.org/r/CAHk-=wgMiSKXf7SvQrfEnxVtmT=QVQPjJdNjfm3aXS7wc=rzTw@mail.gmail.com/
Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Suggested-by: Linus Torvalds <[email protected]>
Reviewed-by: Armin Wolf <[email protected]>
Signed-off-by: Kurt Borja <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Ilpo Järvinen <[email protected]>
Signed-off-by: Ilpo Järvinen <[email protected]>
Diffstat (limited to 'drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c')
| -rw-r--r-- | drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c index 8cc212c85266..fc2f58b4cbc6 100644 --- a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c +++ b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c @@ -23,9 +23,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID); if (!obj) return -EIO; - if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { + if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < ENUM_MIN_ELEMENTS || + obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { kfree(obj); - return -EINVAL; + return -EIO; } ret = snprintf(buf, PAGE_SIZE, "%s\n", obj->package.elements[CURRENT_VAL].string.pointer); kfree(obj); |