Unverified Commit 3c34471c authored by Pengpeng Hou's avatar Pengpeng Hou Committed by Ilpo Järvinen
Browse files

platform/x86: dell-wmi-sysman: bound enumeration string aggregation 



populate_enum_data() aggregates firmware-provided value-modifier
and possible-value strings into fixed 512-byte struct members.
The current code bounds each individual source string but then
appends every string and separator with raw strcat() and no
remaining-space check.

Switch the aggregation loops to a bounded append helper and
reject enumeration packages whose combined strings do not fit
in the destination buffers.

Fixes: e8a60aa7 ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Signed-off-by: default avatarPengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260408084501.1-dell-wmi-sysman-v2-pengpeng@iscas.ac.cn


[ij: add include]
Reviewed-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
parent e8c59736

drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c

+28 −6
Original line number Diff line number Diff line
@@ -6,10 +6,32 @@ 
 *  Copyright (c) 2020 Dell Inc.

 */



#include <linux/bug.h>



#include "dell-wmi-sysman.h"



get_instance_id(enumeration);



static int append_enum_string(char *dest, const char *src)

{

	size_t dest_len = strlen(dest);

	ssize_t copied;



	if (WARN_ON_ONCE(dest_len >= MAX_BUFF))

		return -EINVAL;



	copied = strscpy(dest + dest_len, src, MAX_BUFF - dest_len);

	if (copied < 0)

		return -EINVAL;



	dest_len += copied;

	copied = strscpy(dest + dest_len, ";", MAX_BUFF - dest_len);

	if (copied < 0)

		return -EINVAL;



	return 0;

}



static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)

{

	int instance_id = get_enumeration_instance_id(kobj);
@@ -176,9 +198,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id, 
			return -EINVAL;

		if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING))

			return -EINVAL;

		strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier,

			enumeration_obj[next_obj++].string.pointer);

		strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, ";");

		if (append_enum_string(wmi_priv.enumeration_data[instance_id].dell_value_modifier,

				       enumeration_obj[next_obj++].string.pointer))

			return -EINVAL;

	}



	if (next_obj >= enum_property_count)
@@ -193,9 +215,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id, 
			return -EINVAL;

		if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING))

			return -EINVAL;

		strcat(wmi_priv.enumeration_data[instance_id].possible_values,

			enumeration_obj[next_obj++].string.pointer);

		strcat(wmi_priv.enumeration_data[instance_id].possible_values, ";");

		if (append_enum_string(wmi_priv.enumeration_data[instance_id].possible_values,

				       enumeration_obj[next_obj++].string.pointer))

			return -EINVAL;

	}



	return sysfs_create_group(attr_name_kobj, &enumeration_attr_group);