diff options
| author | Mario Limonciello <mario.limonciello@dell.com> | 2021-01-29 18:26:54 +0100 |
|---|---|---|
| committer | Hans de Goede <hdegoede@redhat.com> | 2021-01-31 20:58:58 +0100 |
| commit | 64b0efa18f8c3b1baac369b8d74d0fdae02bc4bc (patch) | |
| tree | f3ff3d8950dfd79e585226b7734e88f83409c257 /drivers/platform | |
| parent | platform/x86: thinkpad_acpi: set keyboard language (diff) | |
| download | linux-64b0efa18f8c3b1baac369b8d74d0fdae02bc4bc.tar.xz linux-64b0efa18f8c3b1baac369b8d74d0fdae02bc4bc.zip | |
platform/x86: dell-wmi-sysman: fix a NULL pointer dereference
An upcoming Dell platform is causing a NULL pointer dereference
in dell-wmi-sysman initialization. Validate that the input from
BIOS matches correct ACPI types and abort module initialization
if it fails.
Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
Tested-by: Perry Yuan <perry_yuan@dell.com>
Link: https://lore.kernel.org/r/20210129172654.2326751-1-mario.limonciello@dell.com
[hdegoede@redhat.com: Drop redundant release_attributes_data() call]
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/x86/dell-wmi-sysman/sysman.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/platform/x86/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell-wmi-sysman/sysman.c index dc6dd531c996..cb81010ba1a2 100644 --- a/drivers/platform/x86/dell-wmi-sysman/sysman.c +++ b/drivers/platform/x86/dell-wmi-sysman/sysman.c @@ -419,13 +419,17 @@ static int init_bios_attributes(int attr_type, const char *guid) return retval; /* need to use specific instance_id and guid combination to get right data */ obj = get_wmiobj_pointer(instance_id, guid); - if (!obj) + if (!obj || obj->type != ACPI_TYPE_PACKAGE) return -ENODEV; elements = obj->package.elements; mutex_lock(&wmi_priv.mutex); while (elements) { /* sanity checking */ + if (elements[ATTR_NAME].type != ACPI_TYPE_STRING) { + pr_debug("incorrect element type\n"); + goto nextobj; + } if (strlen(elements[ATTR_NAME].string.pointer) == 0) { pr_debug("empty attribute found\n"); goto nextobj; |