After calling wmidev_evaluate_method(), if the ACPI core does not return
an out object, then wmidev_invoke_method() bypasses the min_size check
and returns 0. Add a check for min_size if there is not an out object.

Fixes: 1aeded2f55f0 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
---
 drivers/platform/wmi/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c
index 7aa40dab6145..5a2ffcbab6af 100644
--- a/drivers/platform/wmi/core.c
+++ b/drivers/platform/wmi/core.c
@@ -411,6 +411,9 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
 
 	obj = aout.pointer;
 	if (!obj) {
+		if (min_size != 0)
+			return -ENOMSG;
+
 		out->length = 0;
 		out->data = ZERO_SIZE_PTR;
 

---
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
change-id: 20260429-invoke-fix-44f026f90c56

-- 
Thanks, 
 ~ Kurt

On Wed, 29 Apr 2026 08:20:56 -0500, Kurt Borja wrote:

> After calling wmidev_evaluate_method(), if the ACPI core does not return
> an out object, then wmidev_invoke_method() bypasses the min_size check
> and returns 0. Add a check for min_size if there is not an out object.
> 
> 


Thank you for your contribution, it has been applied to my local
review-ilpo-fixes branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
local branch there, which might take a while.

The list of commits applied:
[1/1] platform/wmi: Fix unchecked min_size in wmidev_invoke_method()
      commit: d3b7a868f1aeb6a43de880a3709ef3a0341f2c2a

--
 i.

Am 29.04.26 um 15:20 schrieb Kurt Borja:

> After calling wmidev_evaluate_method(), if the ACPI core does not return
> an out object, then wmidev_invoke_method() bypasses the min_size check
> and returns 0. Add a check for min_size if there is not an out object.

Reviewed-by: Armin Wolf <W_Armin@gmx.de>

> Fixes: 1aeded2f55f0 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
> Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
> Signed-off-by: Kurt Borja <kuurtb@gmail.com>
> ---
>   drivers/platform/wmi/core.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c
> index 7aa40dab6145..5a2ffcbab6af 100644
> --- a/drivers/platform/wmi/core.c
> +++ b/drivers/platform/wmi/core.c
> @@ -411,6 +411,9 @@ int wmidev_invoke_method(struct wmi_device *wdev, u8 instance, u32 method_id,
>   
>   	obj = aout.pointer;
>   	if (!obj) {
> +		if (min_size != 0)
> +			return -ENOMSG;
> +
>   		out->length = 0;
>   		out->data = ZERO_SIZE_PTR;
>   
>
> ---
> base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
> change-id: 20260429-invoke-fix-44f026f90c56
>