From: Tristan Madani hp_wmi_perform_query() casts the WMI return buffer to struct bios_return without first checking that the buffer is large enough. If firmware returns a buffer shorter than sizeof(struct bios_return), the subsequent subtraction on buffer.length underflows, causing memcpy to copy a near-maximal number of bytes and crash the kernel. Add a buffer length check before accessing the return data, matching the validation already present in the sibling hp-bioscfg driver. Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/platform/x86/hp/hp-wmi.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c index 615b4cf6fc451..81c0acc874f8e 100644 --- a/drivers/platform/x86/hp/hp-wmi.c +++ b/drivers/platform/x86/hp/hp-wmi.c @@ -697,6 +697,13 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command, goto out_free; } + if (obj->buffer.length < sizeof(*bios_return)) { + pr_warn("query 0x%x returned undersized buffer (%u < %zu)\n", + query, obj->buffer.length, sizeof(*bios_return)); + ret = -EINVAL; + goto out_free; + } + bios_return = (struct bios_return *)obj->buffer.pointer; ret = bios_return->return_code; -- 2.47.3