Received-SPF: pass (google.com: domain of linux-kernel+bounces-57007-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Armin Wolf <W_Armin@gmx.de>
To: hdegoede@redhat.com,
	ilpo.jarvinen@linux.intel.com
Cc: platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH] platform/x86: wmi: Make input buffer madatory when evaulating methods
Date: Wed,  7 Feb 2024 21:20:12 +0100
Message-Id: <20240207202012.3506-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:GB9CGCrhmE0=;DXg19GSNS+0KObxmVvH1qe6KNi0
 w1YRx2K0dQMj2Eqn8ohC+8TTRuNxg6625L/HlejmZWqPW8OH/4e0hoT/cEPkrhfKkTXaRrTiR
 GfRB1lOkQxjYdMv2zV2rUsCRkNRlrhjYT7H+2lcJZJZsgQWRuczQGMq9PlWUTpWIsCLy4v4Bj
 xjGbCwWdsZ5IKLQa3EaoEA9Ca4/G/JBdXtI8oj1ZBAKkSryF/OGostwr2JSCga6JOdLzgB5wV
 FEYYaotfAKAp8EG4glBuY9/UfWSrupvhiIVH2dqJ22zP5+pOo8Zy4nt0Cnj7TcglGn7HJZ4KF
 v2hkE980fRdUkxZKQJnmeX+jP6WfKLuWYYIS3HJtrK4BEhwyodbQBDUSMIqeX5Zinxc0dKu+w
 KyL2MfmAq36L+fAkl2flzQjzsU2JG7Bp0h44WGtYgRJve+Otm5ad0p2cuzDBKqHEr5fouNrZP
 ifpJ6whl7NDHkdzvfxm41q75WmK4GWEJ6SFPm+5x+08Ao8ZBE9qBnqCDeO+qS1Rh3caeXsVDI
 LywdfHERYfq6+SFk4KOYfoF15dyyTwkcd0nL40WRLizBsZe1CpGAZaNqo492Slsj4zWpr474V
 kwTX6ePzj5e2jfxkRhyLcSFypykko57Vv7QwriEqxs9NoffaMomaBqOq77n7CiuR7Z2s5Nhh3
 jWq9tU02z0ZgS/L651+wF0tVrVYEGtjD0ThVOdQ0rlqmdJ6DV90kYAkZY2H1HYo5hDYyyeAnu
 dDOen5/6ioapTjhpxn2Vy11qH4leBzSCpCPdce7bfvBqrYUmU8uKnHIM84ILPsbS9xvM2FeGT
 e4YQN5gBnJTKc1la06+/I2ReLuvQbOOo6BdmQfc/H2VoQ=

The ACPI-WMI specification declares that a WMxx control method takes
3 arguments: instance, method id and argument buffer. This is also
the case even when the underlying WMI method does not have any
input arguments.

So if a WMI driver evaluates a WMI method without passing an input
buffer, ACPICA will log a warning complaining that the third argument
is missing.

Prevent this by checking that a input buffer was passed, and return
an error if this was not the case.

Tested on a Asus PRIME B650-Plus.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/platform/x86/wmi.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 63906fdd0abf..f9e23d491dd9 100644
=2D-- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -296,7 +296,7 @@ EXPORT_SYMBOL_GPL(wmidev_instance_count);
  * @guid_string: 36 char string of the form fa50ff2b-f2e8-45de-83fa-65417=
f2f49ba
  * @instance: Instance index
  * @method_id: Method ID to call
- * @in: Buffer containing input for the method call
+ * @in: Mandatory buffer containing input for the method call
  * @out: Empty buffer to return the method results
  *
  * Call an ACPI-WMI method, the caller must free @out.
@@ -326,7 +326,7 @@ EXPORT_SYMBOL_GPL(wmi_evaluate_method);
  * @wdev: A wmi bus device from a driver
  * @instance: Instance index
  * @method_id: Method ID to call
- * @in: Buffer containing input for the method call
+ * @in: Mandatory buffer containing input for the method call
  * @out: Empty buffer to return the method results
  *
  * Call an ACPI-WMI method, the caller must free @out.
@@ -347,26 +347,25 @@ acpi_status wmidev_evaluate_method(struct wmi_device=
 *wdev, u8 instance, u32 met
 	block =3D &wblock->gblock;
 	handle =3D wblock->acpi_device->handle;

+	if (!in)
+		return AE_BAD_DATA;
+
 	if (!(block->flags & ACPI_WMI_METHOD))
 		return AE_BAD_DATA;

 	if (block->instance_count <=3D instance)
 		return AE_BAD_PARAMETER;

-	input.count =3D 2;
+	input.count =3D 3;
 	input.pointer =3D params;
+
 	params[0].type =3D ACPI_TYPE_INTEGER;
 	params[0].integer.value =3D instance;
 	params[1].type =3D ACPI_TYPE_INTEGER;
 	params[1].integer.value =3D method_id;
-
-	if (in) {
-		input.count =3D 3;
-
-		params[2].type =3D get_param_acpi_type(wblock);
-		params[2].buffer.length =3D in->length;
-		params[2].buffer.pointer =3D in->pointer;
-	}
+	params[2].type =3D get_param_acpi_type(wblock);
+	params[2].buffer.length =3D in->length;
+	params[2].buffer.pointer =3D in->pointer;

 	get_acpi_method_name(wblock, 'M', method);

=2D-
2.39.2