Commit 64b0efa1 authored by Mario Limonciello's avatar Mario Limonciello Committed by Hans de Goede

platform/x86: dell-wmi-sysman: fix a NULL pointer dereference

An upcoming Dell platform is causing a NULL pointer dereference
in dell-wmi-sysman initialization.  Validate that the input from
BIOS matches correct ACPI types and abort module initialization
if it fails.
Signed-off-by: default avatarMario Limonciello <mario.limonciello@dell.com>
Tested-by: default avatarPerry Yuan <perry_yuan@dell.com>
Link: https://lore.kernel.org/r/20210129172654.2326751-1-mario.limonciello@dell.com
[hdegoede@redhat.com: Drop redundant release_attributes_data() call]
Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
parent d7cbe277
...@@ -419,13 +419,17 @@ static int init_bios_attributes(int attr_type, const char *guid) ...@@ -419,13 +419,17 @@ static int init_bios_attributes(int attr_type, const char *guid)
return retval; return retval;
/* need to use specific instance_id and guid combination to get right data */ /* need to use specific instance_id and guid combination to get right data */
obj = get_wmiobj_pointer(instance_id, guid); obj = get_wmiobj_pointer(instance_id, guid);
if (!obj) if (!obj || obj->type != ACPI_TYPE_PACKAGE)
return -ENODEV; return -ENODEV;
elements = obj->package.elements; elements = obj->package.elements;
mutex_lock(&wmi_priv.mutex); mutex_lock(&wmi_priv.mutex);
while (elements) { while (elements) {
/* sanity checking */ /* sanity checking */
if (elements[ATTR_NAME].type != ACPI_TYPE_STRING) {
pr_debug("incorrect element type\n");
goto nextobj;
}
if (strlen(elements[ATTR_NAME].string.pointer) == 0) { if (strlen(elements[ATTR_NAME].string.pointer) == 0) {
pr_debug("empty attribute found\n"); pr_debug("empty attribute found\n");
goto nextobj; goto nextobj;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment