This series fixes attribute enumeration failures on the HP EliteBook 840
G2 (BIOS M71 Ver. 01.31), whose BIOS returns shorter ACPI WMI packages
than hp_init_bios_package_attribute() currently accepts, plus occasional
type-mismatched elements after a failed WMI query.
Patches 1 and 2 are prerequisites: they make each per-type parser bound
itself on the real, validated package count instead of an incorrect value
derived from the NAME string's length. Both are no-ops today, since
every package the driver currently handles already meets the old
minimum size. They matter because patch 3 depends on them: once the
minimum size check is relaxed, the elements array can genuinely be
smaller than a parser's fixed per-type count, and without patches 1 and
2 this would result in an out-of-bounds heap read.
Patch 3 relaxes that minimum size check to accept packages missing
optional type-specific fields, as long as the common fields (NAME
through SECURITY_LEVEL) are present.
Patch 4 changes a type mismatch on one element from aborting the whole
attribute to warning and skipping the offending element, matching the
existing handling of unsupported element types.
Patches 1 through 3 are intended to be applied together, as patch 3
depends on the preparatory fixes in patches 1 and 2.
v4: https://lore.kernel.org/all/20260708154846.12356-1-meatuni001@gmail.com/
Changes since v4:
- Patch 1: added missing kerneldoc @foo_count entries for the five new
parameters. (Ilpo)
- No other code changes.
Changes since v3:
- Patch 1: dropped the Fixes: tag (the patch does not fix anything on
its own; Cc: stable is enough for stable to pull it in as a series
dependency) and reworded the forward reference from "a later patch"
to "an upcoming change". (Ilpo)
- Patch 2: dropped the Fixes: tag and reworded the forward reference as
in patch 1, plus dropped the redundant sentence describing the
out-of-bounds read. (Ilpo)
- No code changes; commit-message wording only.
Changes since v2:
- Split the single "pass validated count and bound ordered list
parsing" patch into two: patch 1 fixes the count value passed to
each wrapper, patch 2 adds the missing elem < count bound to the
ordered list parser. (Ilpo)
- Rewrote patch 1's commit message to lead with the bug instead of
quoting code, and to state up front that a later patch depends on
it. (Ilpo)
- Reworded "thread the count down" and "guess at it" phrasing. (Ilpo)
Muhammad Bilal (4):
platform/x86: hp-bioscfg: pass validated element count to package
parsers
platform/x86: hp-bioscfg: bound ordered-list parsing by the package
count
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP
BIOS
platform/x86: hp-bioscfg: warn on element type mismatch instead of
failing
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 16 +++++++++++++---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 ++++++++
.../platform/x86/hp/hp-bioscfg/enum-attributes.c | 11 +++++++----
.../platform/x86/hp/hp-bioscfg/int-attributes.c | 4 +++-
.../x86/hp/hp-bioscfg/order-list-attributes.c | 8 +++++---
.../x86/hp/hp-bioscfg/passwdobj-attributes.c | 6 ++++--
.../x86/hp/hp-bioscfg/string-attributes.c | 4 +++-
7 files changed, 43 insertions(+), 14 deletions(-)
--
2.55.0