[PATCH v2] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

[PATCH v2] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

[Muhammad Bilal]

hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
struct bios_return header in the returned buffer. However, it only
checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).

If the firmware or ACPI method returns a buffer shorter than 8 bytes:

1. bios_return->return_code at offset 4 reads out of bounds from the
   allocated ACPI buffer slab.

2. If return_code evaluates to 0 and outsize is non-zero,
   (int)(obj->buffer.length - sizeof(*bios_return)) evaluates to a
   negative integer (e.g. -8 for a 0-length buffer). actual_outsize is
   set to this negative value and passed to memcpy(buffer, ...,
   actual_outsize), where the signed negative value is cast to
   size_t (e.g. 0xfffffffffffffff8), attempting to copy ~18 Exabytes
   and triggering an immediate kernel crash. Additionally,
   memset(buffer + actual_outsize, ...) performs an out-of-bounds
   write before buffer.

Fix this by ensuring obj->buffer.length is at least sizeof(*bios_return)
before accessing the return code, and compute actual_outsize safely
using min_t(u32, ...), which is sound specifically because the guard
above already rules out obj->buffer.length being smaller than
sizeof(*bios_return) by the time that subtraction runs.

Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
v2: Rebased onto current platform-drivers-x86.git 'fixes' (confirmed
    matching current mainline, blob b2773fc1aca414792b99406315496a2c3a64dd06).
    v1 was diffed against a stale local copy of hp-wmi.c that predated
    a batch of unrelated upstream changes (GPU MUX switch support, new
    OMEN/Victus board IDs), so its hunks no longer applied. The fix
    itself is unchanged, only the base and line numbers moved. Also
    correcting the recipient list: Hans de Goede's address is
    hdegoede@redhat.com, not hansg@kernel.org as v1 had it.

 drivers/platform/x86/hp/hp-wmi.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index b2773fc..d7ad206 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -691,8 +691,9 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		goto out_free;
 	}
 
-	if (obj->type != ACPI_TYPE_BUFFER) {
-		pr_warn("query 0x%x returned an invalid object 0x%x\n", query, ret);
+	if (obj->type != ACPI_TYPE_BUFFER ||
+	    obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned wrong type or too small buffer\n", query);
 		ret = -EINVAL;
 		goto out_free;
 	}
@@ -711,7 +712,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 	if (!outsize)
 		goto out_free;
 
-	actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
+	actual_outsize = min_t(u32, outsize, obj->buffer.length - sizeof(*bios_return));
 	memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
 	memset(buffer + actual_outsize, 0, outsize - actual_outsize);
 
-- 
2.55.0

Re: [PATCH v2] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

[Muhammad Bilal]

ping.

On Wed, Aug 26, 2026 at 3:30 PM Muhammad Bilal <meatuni001@gmail.com> wrote:
>
> hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
> struct bios_return header in the returned buffer. However, it only
> checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
> that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).
>
> If the firmware or ACPI method returns a buffer shorter than 8 bytes:
>
> 1. bios_return->return_code at offset 4 reads out of bounds from the
>    allocated ACPI buffer slab.
>
> 2. If return_code evaluates to 0 and outsize is non-zero,
>    (int)(obj->buffer.length - sizeof(*bios_return)) evaluates to a
>    negative integer (e.g. -8 for a 0-length buffer). actual_outsize is
>    set to this negative value and passed to memcpy(buffer, ...,
>    actual_outsize), where the signed negative value is cast to
>    size_t (e.g. 0xfffffffffffffff8), attempting to copy ~18 Exabytes
>    and triggering an immediate kernel crash. Additionally,
>    memset(buffer + actual_outsize, ...) performs an out-of-bounds
>    write before buffer.
>
> Fix this by ensuring obj->buffer.length is at least sizeof(*bios_return)
> before accessing the return code, and compute actual_outsize safely
> using min_t(u32, ...), which is sound specifically because the guard
> above already rules out obj->buffer.length being smaller than
> sizeof(*bios_return) by the time that subtraction runs.
>
> Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> v2: Rebased onto current platform-drivers-x86.git 'fixes' (confirmed
>     matching current mainline, blob b2773fc1aca414792b99406315496a2c3a64dd06).
>     v1 was diffed against a stale local copy of hp-wmi.c that predated
>     a batch of unrelated upstream changes (GPU MUX switch support, new
>     OMEN/Victus board IDs), so its hunks no longer applied. The fix
>     itself is unchanged, only the base and line numbers moved. Also
>     correcting the recipient list: Hans de Goede's address is
>     hdegoede@redhat.com, not hansg@kernel.org as v1 had it.
>
>  drivers/platform/x86/hp/hp-wmi.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
> index b2773fc..d7ad206 100644
> --- a/drivers/platform/x86/hp/hp-wmi.c
> +++ b/drivers/platform/x86/hp/hp-wmi.c
> @@ -691,8 +691,9 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
>                 goto out_free;
>         }
>
> -       if (obj->type != ACPI_TYPE_BUFFER) {
> -               pr_warn("query 0x%x returned an invalid object 0x%x\n", query, ret);
> +       if (obj->type != ACPI_TYPE_BUFFER ||
> +           obj->buffer.length < sizeof(*bios_return)) {
> +               pr_warn("query 0x%x returned wrong type or too small buffer\n", query);
>                 ret = -EINVAL;
>                 goto out_free;
>         }
> @@ -711,7 +712,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
>         if (!outsize)
>                 goto out_free;
>
> -       actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
> +       actual_outsize = min_t(u32, outsize, obj->buffer.length - sizeof(*bios_return));
>         memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
>         memset(buffer + actual_outsize, 0, outsize - actual_outsize);
>
> --
> 2.55.0
>

Re: [PATCH v2] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

[Ilpo Järvinen]

On Wed, 26 Aug 2026 15:30:12 +0500, Muhammad Bilal wrote:

> hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
> struct bios_return header in the returned buffer. However, it only
> checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
> that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).
> 
> If the firmware or ACPI method returns a buffer shorter than 8 bytes:
> 
> [...]

Thank you for your contribution, it has been applied to my local
review-ilpo-next branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-next branch only once I've pushed my
local branch there, which might take a while.

FYI [if applicable to your patch], as per Linus' policy change, also
fixes are mostly routed through for-next unless the fix is for a
commit introduced in the most recent cycle or is clearly a regression
fix.

The list of commits applied:
[1/1] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()
      commit: c59252fa6260423ec3c4aa90b144fcad66851c76

--
 i.