Re: [PATCH v6 6/9] hwmon: (dell-smm) Use new buffer-based WMI API

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] wmi_parse_response incorrectly fails with -ENODATA when the firmware returns fewer than 4 registers, breaking support for valid short SMM responses.
--

commit 5defcd15874af970946561c0d13ad1b0850d56ca
Author: Armin Wolf <W_Armin@gmx.de>
hwmon: (dell-smm) Use new buffer-based WMI API

This commit updates the dell-smm-hwmon driver to use the new buffer-based WMI
API. This allows the driver to also support ACPI firmware implementations that
do not use ACPI buffers for returning the results of a SMM call.

> diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
> index 038edffc1ac74..6ca2ea4bfe7d3 100644
> --- a/drivers/hwmon/dell-smm-hwmon.c
> +++ b/drivers/hwmon/dell-smm-hwmon.c
> @@ -261,22 +263,19 @@ static int wmi_parse_response(u8 *buffer, u32 length, struct smm_regs *regs)
>  		&regs->ecx,
>  		&regs->edx
>  	};
> -	u32 offset = 0;
> +	size_t offset = 0;
>  	ssize_t ret;
>  	int i;
>  
>  	for (i = 0; i < ARRAY_SIZE(registers); i++) {
>  		if (offset >= length)
>  			return -ENODATA;
>  
>  		ret = wmi_parse_register(buffer + offset, length - offset, registers[i]);
>  		if (ret < 0)
>  			return ret;
>  
> -		offset += ret;
> +		/* WMI aligns u32 integers on a 4 byte boundary */
> +		offset = ALIGN(offset + ret, 4);
>  	}
>  
> -	if (offset != length)
> -		return -ENOMSG;
> -
>  	return 0;
>  }

[Severity: High]
Does wmi_parse_response() incorrectly fail with -ENODATA when the firmware
returns fewer than 4 registers, breaking support for valid short SMM responses?

Based on the changes, it appears the parsing loop previously allowed a short
response to be fully consumed (where offset == length), eventually verifying
it and successfully returning 0 while leaving any unprovided registers
unchanged.

With the updated code, if a BIOS legitimately returns a valid WMI response
containing 1, 2, or 3 registers (e.g., 8, 16, or 24 bytes), the loop parses
the provided registers and increments offset to equal length. On the
subsequent iteration, it evaluates offset >= length as true. 

Instead of succeeding, will this now fail the entire SMM call with -ENODATA?

Could this functional regression break hardware monitoring (e.g., fan speed,
temperatures) on Dell systems whose BIOS provides short WMI SMM responses?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610203453.816254-1-W_Armin@gmx.de?part=6