[PATCH 0/5] platform/x86: hp-wmi: Fix WMI error handling

[PATCH 0/5] platform/x86: hp-wmi: Fix WMI error handling

[Emre Cecanpunar]

Fix several places where hp-wmi either trusts an undersized firmware
response or mistakes a positive HP firmware error for success.

The affected paths handle the common WMI response header, tablet-mode
switch updates, the OMEN key event, Victus GPU thermal modes and Victus
fan-speed control.  Each patch is independent and can be applied on its
own.

Emre Cecanpunar (5):
  platform/x86: hp-wmi: validate WMI response header size
  platform/x86: hp-wmi: handle firmware errors in tablet mode query
  platform/x86: hp-wmi: handle errors in the OMEN key event
  platform/x86: hp-wmi: normalize GPU thermal mode errors
  platform/x86: hp-wmi: report fan speed command failures

 drivers/platform/x86/hp/hp-wmi.c | 64 +++++++++++++++++++++-----------
 1 file changed, 43 insertions(+), 21 deletions(-)


base-commit: 2b3a5dabe89e330413af403246b648c1890f368f

[PATCH 1/5] platform/x86: hp-wmi: validate WMI response header size

[Emre Cecanpunar]

hp_wmi_perform_query() reads struct bios_return without checking that
the firmware response buffer is large enough to contain it. A truncated
response can therefore cause an out-of-bounds read.

Reject responses shorter than the mandatory header before accessing its
fields or calculating the payload offset.

Fixes: 62ec30d45ecb ("misc: add HP WMI laptop extras driver")
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 5353d997d272..205a6020e9c5 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -670,6 +670,11 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		ret = -EINVAL;
 		goto out_free;
 	}
+	if (obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned a short buffer\n", query);
+		ret = -EINVAL;
+		goto out_free;
+	}
 
 	bios_return = (struct bios_return *)obj->buffer.pointer;
 	ret = bios_return->return_code;

[PATCH 2/5] platform/x86: hp-wmi: handle firmware errors in tablet mode query

[Emre Cecanpunar]

hp_wmi_get_tablet_mode() accepts any nonnegative return value from
hp_wmi_perform_query() as success. HP firmware errors are positive, so a
rejected query makes the zeroed response look like laptop mode.

Treat every nonzero result as an error and preserve negative transport
errors. The event and resume paths pass the result directly to the input
subsystem, where a negative errno would look like an asserted switch, so
skip the switch update when the query fails.

Fixes: 520ee4ea1cc6 ("platform/x86: hp-wmi: Fix SW_TABLET_MODE detection method")
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 205a6020e9c5..e226b772ef00 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -798,8 +798,8 @@ static int hp_wmi_get_tablet_mode(void)
 	ret = hp_wmi_perform_query(HPWMI_SYSTEM_DEVICE_MODE, HPWMI_READ,
 				   system_device_mode, zero_if_sup(system_device_mode),
 				   sizeof(system_device_mode));
-	if (ret < 0)
-		return ret;
+	if (ret)
+		return ret < 0 ? ret : -EINVAL;
 
 	return system_device_mode[0] == DEVICE_MODE_TABLET;
 }
@@ -1198,7 +1198,7 @@ static void hp_wmi_notify(union acpi_object *obj, void *context)
 {
 	u32 event_id, event_data;
 	u32 *location;
-	int key_code;
+	int key_code, state;
 
 	if (!obj)
 		return;
@@ -1228,9 +1228,12 @@ static void hp_wmi_notify(union acpi_object *obj, void *context)
 		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
 			input_report_switch(hp_wmi_input_dev, SW_DOCK,
 					    hp_wmi_get_dock_state());
-		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
-			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-					    hp_wmi_get_tablet_mode());
+		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) {
+			state = hp_wmi_get_tablet_mode();
+			if (state >= 0)
+				input_report_switch(hp_wmi_input_dev,
+						    SW_TABLET_MODE, state);
+		}
 		input_sync(hp_wmi_input_dev);
 		break;
 	case HPWMI_PARK_HDD:
@@ -2431,6 +2434,8 @@ static void __exit hp_wmi_bios_remove(struct platform_device *device)
 
 static int hp_wmi_resume_handler(struct device *device)
 {
+	int state;
+
 	/*
 	 * Hardware state may have changed while suspended, so trigger
 	 * input events for the current state. As this is a switch,
@@ -2441,9 +2446,12 @@ static int hp_wmi_resume_handler(struct device *device)
 		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
 			input_report_switch(hp_wmi_input_dev, SW_DOCK,
 					    hp_wmi_get_dock_state());
-		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
-			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-					    hp_wmi_get_tablet_mode());
+		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) {
+			state = hp_wmi_get_tablet_mode();
+			if (state >= 0)
+				input_report_switch(hp_wmi_input_dev,
+						    SW_TABLET_MODE, state);
+		}
 		input_sync(hp_wmi_input_dev);
 	}
 

[PATCH 3/5] platform/x86: hp-wmi: handle errors in the OMEN key event

[Emre Cecanpunar]

hp_wmi_read_int() can return a negative error code, but the
HPWMI_OMEN_KEY handler passes it directly to
sparse_keymap_report_event(). The value is then converted to an unsigned
key code, causing a bogus lookup and a KEY_UNKNOWN input event.

Stop processing the event when reading the key code fails, mirroring the
existing check in the HPWMI_BEZEL_BUTTON handler.

Fixes: f4a31a428d0d ("platform/x86: hp-wmi: Add HP Envy special key support")
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index e226b772ef00..29881749aae6 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -1253,10 +1253,14 @@ static void hp_wmi_notify(union acpi_object *obj, void *context)
 		platform_profile_cycle();
 		break;
 	case HPWMI_OMEN_KEY:
-		if (event_data) /* Only should be true for HP Omen */
+		if (event_data) {
+			/* Only should be true for HP Omen */
 			key_code = event_data;
-		else
+		} else {
 			key_code = hp_wmi_read_int(HPWMI_HOTKEY_QUERY);
+			if (key_code < 0)
+				break;
+		}
 
 		if (!sparse_keymap_report_event(hp_wmi_input_dev,
 						key_code, 1, true))

[PATCH 4/5] platform/x86: hp-wmi: normalize GPU thermal mode errors

[Emre Cecanpunar]

The GPU thermal mode helpers return positive firmware error codes, but
their callers only treat negative values as failures. If the mode query
is rejected, its output parameters remain uninitialized and are then
used to select a profile or sent back to firmware as the GPU slowdown
temperature. A rejected mode update is likewise reported as successful.

Zero the query buffer and convert positive firmware status codes to
-EINVAL in both helpers so callers never consume missing output or ignore
a failed update.

Fixes: 6e4ab59b8391 ("platform/x86: hp-wmi: Add fan and thermal profile support for Victus 16-s1000")
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 29881749aae6..65c3bac17ad6 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -1885,20 +1885,21 @@ static int victus_s_gpu_thermal_profile_get(bool *ctgp_enable,
 					    u8 *dstate,
 					    u8 *gpu_slowdown_temp)
 {
-	struct victus_gpu_power_modes gpu_power_modes;
+	struct victus_gpu_power_modes gpu_power_modes = {};
 	int ret;
 
 	ret = hp_wmi_perform_query(HPWMI_GET_GPU_THERMAL_MODES_QUERY, HPWMI_GM,
 				   &gpu_power_modes, sizeof(gpu_power_modes),
 				   sizeof(gpu_power_modes));
-	if (ret == 0) {
-		*ctgp_enable = gpu_power_modes.ctgp_enable ? true : false;
-		*ppab_enable = gpu_power_modes.ppab_enable ? true : false;
-		*dstate = gpu_power_modes.dstate;
-		*gpu_slowdown_temp = gpu_power_modes.gpu_slowdown_temp;
-	}
+	if (ret)
+		return ret < 0 ? ret : -EINVAL;
 
-	return ret;
+	*ctgp_enable = gpu_power_modes.ctgp_enable ? true : false;
+	*ppab_enable = gpu_power_modes.ppab_enable ? true : false;
+	*dstate = gpu_power_modes.dstate;
+	*gpu_slowdown_temp = gpu_power_modes.gpu_slowdown_temp;
+
+	return 0;
 }
 
 static int victus_s_gpu_thermal_profile_set(bool ctgp_enable,
@@ -1929,8 +1930,10 @@ static int victus_s_gpu_thermal_profile_set(bool ctgp_enable,
 
 	ret = hp_wmi_perform_query(HPWMI_SET_GPU_THERMAL_MODES_QUERY, HPWMI_GM,
 				   &gpu_power_modes, sizeof(gpu_power_modes), 0);
+	if (ret)
+		return ret < 0 ? ret : -EINVAL;
 
-	return ret;
+	return 0;
 }
 
 /* Note: HP_POWER_LIMIT_DEFAULT can be used to restore default PL1 and PL2 */

[PATCH 5/5] platform/x86: hp-wmi: report fan speed command failures

[Emre Cecanpunar]

hp_wmi_fan_speed_set() passes the raw WMI result to
hp_wmi_apply_fan_settings(), which only checks for negative errors. A
positive HP firmware error consequently reaches the success path and
schedules keep-alive work for a fan speed that was not applied.

Convert positive firmware errors to -EINVAL before returning from the fan
speed helper, matching the other fan control commands.

Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive")
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
---
 drivers/platform/x86/hp/hp-wmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 65c3bac17ad6..8f8da31bd5ef 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -907,8 +907,10 @@ static int hp_wmi_fan_speed_set(struct hp_wmi_hwmon_priv *priv)
 		return ret;
 	ret = hp_wmi_perform_query(HPWMI_VICTUS_S_FAN_SPEED_SET_QUERY, HPWMI_GM,
 				   &fan_speed, sizeof(fan_speed), 0);
+	if (ret)
+		return ret < 0 ? ret : -EINVAL;
 
-	return ret;
+	return 0;
 }
 
 static int hp_wmi_fan_speed_reset(struct hp_wmi_hwmon_priv *priv)