Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Armin Wolf <W_Armin@gmx.de>
To:     hdegoede@redhat.com, markgross@kernel.org
Cc:     platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/2] platform/x86: dell-ddv: Improve buffer handling
Date:   Wed,  2 Nov 2022 22:23:35 +0100
Message-Id: <20221102212336.380257-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:9uLHvllaT/A=;ZithkZVRqNPOK2V8hjiT5neSuNo
 cz4HCWUs6YlIDEIj1q11gYFMa7sdja+NrDRs+i/vkbsfLJ0pp4IIZ/E6L+6U9d45BB7kGiDgC
 3XvzC7BuChN0vI8VoHLkvocrYEA6J5MhbBPgkT9pqPAhGq5Y5O3IKW1cDWCz4ZXXxiV7wDZTt
 jTA0EiQDG2pv2JbZnfFnfb+TA/ugtZCmVanHbnBH6PDG8bzsVUmyiX3sucwv5/Ey6SSRdWUCI
 xw9dra48IzB+2v/MehxSJCGBammZLWdlhKTpIH8EhYydgkJ5ZftnOr0eVxNHZ2GDY1ohLhglA
 YjnV3OxwK3nS5muK5uIBFghJ5/jFniqoGTLWhB1LmzdZRS+hzCJ13oUPZ1Pyfy1VQOo1/K/BD
 /ZWezwPJvFktb9tA54fi/3TtWg3AFRxu3N6DMg+cK1DMWcK9cRKRIRj+sP/9eeT1g29afiEPR
 HGC2ctpcH87MKB4SpSATgxw5wVc396SZsJKq2hKkMg270z4kG3Qxdib0ZJXhBlfbFXLpYYaAL
 CG+otK9MUabBNxDtwXdEvLUx1DqHOwlVj/CJuCD1expdXQYy+UuiU2+S7gKXHsdhg+HcGbvNS
 fWMPVv9y/wHiHAYg5knK+uvvDmkaoVDxr/b34iCP5szRRB2B5rU6yrKKp7EjIgEyle6zbQu/+
 FuCktFX1OTiJEQKGM9FuWfv0wFrSCzwEO13eA/ShcTYNPQ2B2nNsJ/Fci0FFTn/hrxU5aaqKf
 Cdx2rfdnjzlvoJOvbajoSvQw+/aPQCTc83Ay74OjohPd2LtiswDNGkvgxQZwnz1DKqyCZm3Rh
 U0YiMlz8BV8cWIkHskJZ9ACoGcbR4L7TyPY8pg1Wst+327R9GE1tfs0OEN69jTbMVsd15qnO/
 KGdNfwXTIyWkxYj5e+o+UddEIMn5sUPGl6voWkS/ylTuS+K+Ph1pMKKmaHhdYV7eHF/s/29sN
 pCvruSvEtcHZB0IPLNYmd+USnxA=
Precedence: bulk

When the DDV interface returns a buffer, it actually
returns a acpi buffer containing an integer (buffer size)
and another acpi buffer (buffer content).
The size of the buffer may be smaller than the size of
the buffer content, which is perfectly valid and should not
be treated as an error.
Also use the buffer size instead of the buffer content size
when accessing the buffer to prevent accessing bogus data.

Tested on a Dell Inspiron 3505.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/platform/x86/dell/dell-wmi-ddv.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x=
86/dell/dell-wmi-ddv.c
index 699feae3c435..1a001296e8c6 100644
=2D-- a/drivers/platform/x86/dell/dell-wmi-ddv.c
+++ b/drivers/platform/x86/dell/dell-wmi-ddv.c
@@ -129,9 +129,9 @@ static int dell_wmi_ddv_query_buffer(struct wmi_device=
 *wdev, enum dell_ddv_meth
 	if (obj->package.elements[1].type !=3D ACPI_TYPE_BUFFER)
 		goto err_free;

-	if (buffer_size !=3D obj->package.elements[1].buffer.length) {
+	if (buffer_size > obj->package.elements[1].buffer.length) {
 		dev_warn(&wdev->dev,
-			 FW_WARN "ACPI buffer size (%llu) does not match WMI buffer size (%d)\=
n",
+			 FW_WARN "WMI buffer size (%llu) exceeds ACPI buffer size (%d)\n",
 			 buffer_size, obj->package.elements[1].buffer.length);

 		goto err_free;
@@ -271,15 +271,17 @@ static int dell_wmi_ddv_buffer_read(struct seq_file =
*seq, enum dell_ddv_method m
 	struct device *dev =3D seq->private;
 	struct dell_wmi_ddv_data *data =3D dev_get_drvdata(dev);
 	union acpi_object *obj;
-	union acpi_object buf;
+	u64 size;
+	u8 *buf;
 	int ret;

 	ret =3D dell_wmi_ddv_query_buffer(data->wdev, method, 0, &obj);
 	if (ret < 0)
 		return ret;

-	buf =3D obj->package.elements[1];
-	ret =3D seq_write(seq, buf.buffer.pointer, buf.buffer.length);
+	size =3D obj->package.elements[0].integer.value;
+	buf =3D obj->package.elements[1].buffer.pointer;
+	ret =3D seq_write(seq, buf, size);
 	kfree(obj);

 	return ret;
=2D-
2.30.2