Re: [PATCH 2/3] hp-wmi: fix potential integer underflow

["Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>]

On Sun, 12 Jul 2026, yahia wrote:

> From: yahia ahmed <yahia.a.abdrabou@gmail.com>
> 
> hp_wmi_query_perform() currently calculates the output size of the
> returned buffer by subtracting the size of bios_return from the length
> sent, However if a malicious bios or a new bios not yet tracked or
> handled sends a length smaller than the size of bios_return, the
> calculation will underflow, then the result will be casted to a signed
> integer, as such the min() function will fail to set the size properly
> leading to a huge number to be passed to memcpy.
> 
> Fix this by adding a check to ensure if the length returned by the bios
> is larger than bios_return.
> 
> Reported-by: sashiko-bot@kernel.org
> Link: https://sashiko.dev/#/patchset/20260706143855.35002-1-yahia.a.abdrabou%40gmail.com
> Fixes: d35c9a029a73 ("platform/x86: hp-wmi: Don't log a warning on HPWMI_RET_UNKNOWN_COMMAND errors")
> Signed-off-by: yahia ahmed <yahia.a.abdrabou@gmail.com>
> ---
>  drivers/platform/x86/hp/hp-wmi.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
> index c924fbb5503f..3235ade2fa98 100644
> --- a/drivers/platform/x86/hp/hp-wmi.c
> +++ b/drivers/platform/x86/hp/hp-wmi.c
> @@ -634,6 +634,10 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
>  	if (!outsize)
>  		return ret;
>  
> +	if (obj->buffer.length < sizeof(*bios_return)) {

This driver is using a deprecated WMI API.

The new WMI API may be able to do size checks for you so you don't need 
to add them to the driver side.

> +		pr_warn("Bios returned invalid data");
> +		return -EINVAL;
> +	}
>  	actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
>  	memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
>  	memset(buffer + actual_outsize, 0, outsize - actual_outsize);
> 

-- 
 i.