| Message ID | 20250208051614.10644-6-kuurtb@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | HWMON support + DebugFS + Improvements | expand |
Am 08.02.25 um 06:16 schrieb Kurt Borja: > Get and store the AWCC system description in alienware_awcc_setup() > instead of awcc_platform_profile_probe() and add a check for integer > overflows to avoid misbehaviors. > > Signed-off-by: Kurt Borja <kuurtb@gmail.com> > --- > .../platform/x86/dell/alienware-wmi-wmax.c | 56 ++++++++++++++----- > 1 file changed, 43 insertions(+), 13 deletions(-) > > diff --git a/drivers/platform/x86/dell/alienware-wmi-wmax.c b/drivers/platform/x86/dell/alienware-wmi-wmax.c > index 4a8335d90b5d..e8fe16da036a 100644 > --- a/drivers/platform/x86/dell/alienware-wmi-wmax.c > +++ b/drivers/platform/x86/dell/alienware-wmi-wmax.c > @@ -12,6 +12,7 @@ > #include <linux/bits.h> > #include <linux/dmi.h> > #include <linux/moduleparam.h> > +#include <linux/overflow.h> > #include <linux/platform_profile.h> > #include <linux/wmi.h> > #include "alienware-wmi.h" > @@ -211,6 +212,17 @@ struct wmax_u32_args { > > struct awcc_priv { > struct wmi_device *wdev; > + union { > + u32 system_description; > + struct { > + u8 fan_count; > + u8 temp_count; > + u8 unknown_count; > + u8 profile_count; > + } __packed; > + u8 res_count[4]; > + } __packed; > + > struct device *ppdev; > u8 supported_profiles[PLATFORM_PROFILE_LAST]; > }; > @@ -614,32 +626,35 @@ static int awcc_platform_profile_probe(void *drvdata, unsigned long *choices) > enum platform_profile_option profile; > struct awcc_priv *priv = drvdata; > enum awcc_thermal_profile mode; > - u8 sys_desc[4]; > - u32 first_mode; > + u8 id, offset = 0; > u32 out_data; > int ret; > - u8 id; > - > - ret = awcc_thermal_information(priv->wdev, AWCC_OP_GET_SYSTEM_DESCRIPTION, > - 0, (u32 *) &sys_desc); > - if (ret < 0) > - return ret; > - > - first_mode = sys_desc[0] + sys_desc[1]; > > - for (u32 i = 0; i < sys_desc[3]; i++) { > - ret = awcc_op_get_resource_id(priv->wdev, i + first_mode, &out_data); > + /* > + * Thermal profile IDs are listed last at offset > + * fan_count + temp_count + unknown_count > + */ > + for (u32 i = 0; i < ARRAY_SIZE(priv->res_count) - 1; i++) > + offset += priv->res_count[i]; > > + for (u32 i = 0; i < priv->profile_count; i++) { > + ret = awcc_op_get_resource_id(priv->wdev, i + offset, &out_data); > if (ret == -EIO) > return ret; > > + /* > + * Some devices report an incorrect number of thermal profiles > + * so the resource ID list may end prematurely > + */ > if (ret == -EBADRQC) > break; > > /* Some IDs have a BIT(8) flag that should be ignored */ > id = FIELD_GET(AWCC_RESOURCE_ID_MASK, out_data); > - if (!is_awcc_thermal_profile_id(id)) > + if (!is_awcc_thermal_profile_id(id)) { > + dev_dbg(&priv->wdev->dev, "Unmapped thermal profile ID 0x%02x\n", id); > continue; > + } > > mode = FIELD_GET(AWCC_THERMAL_MODE_MASK, id); > profile = awcc_mode_to_platform_profile[mode]; > @@ -680,12 +695,27 @@ static int awcc_platform_profile_init(struct wmi_device *wdev) > static int alienware_awcc_setup(struct wmi_device *wdev) > { > struct awcc_priv *priv; > + u8 tot = 0; > int ret; > > priv = devm_kzalloc(&wdev->dev, sizeof(*priv), GFP_KERNEL); > if (!priv) > return -ENOMEM; > > + ret = awcc_thermal_information(wdev, AWCC_OP_GET_SYSTEM_DESCRIPTION, > + 0, &priv->system_description); > + if (ret < 0) > + return ret; > + > + /* Sanity check */ > + for (u32 i = 0; i < ARRAY_SIZE(priv->res_count); i++) { > + if (check_add_overflow(tot, priv->res_count[i], &tot)) { I wonder if it would be easier to just use a int to accumulate all offsets and then check if the resulting value is greater than U8_MAX. Other than that: Reviewed-by: Armin Wolf <W_Armin@gmx.de> > + dev_err(&wdev->dev, "Malformed system description: %u\n", > + priv->system_description); > + return -ENXIO; > + } > + } > + > priv->wdev = wdev; > dev_set_drvdata(&wdev->dev, priv); >
diff --git a/drivers/platform/x86/dell/alienware-wmi-wmax.c b/drivers/platform/x86/dell/alienware-wmi-wmax.c index 4a8335d90b5d..e8fe16da036a 100644 --- a/drivers/platform/x86/dell/alienware-wmi-wmax.c +++ b/drivers/platform/x86/dell/alienware-wmi-wmax.c @@ -12,6 +12,7 @@ #include <linux/bits.h> #include <linux/dmi.h> #include <linux/moduleparam.h> +#include <linux/overflow.h> #include <linux/platform_profile.h> #include <linux/wmi.h> #include "alienware-wmi.h" @@ -211,6 +212,17 @@ struct wmax_u32_args { struct awcc_priv { struct wmi_device *wdev; + union { + u32 system_description; + struct { + u8 fan_count; + u8 temp_count; + u8 unknown_count; + u8 profile_count; + } __packed; + u8 res_count[4]; + } __packed; + struct device *ppdev; u8 supported_profiles[PLATFORM_PROFILE_LAST]; }; @@ -614,32 +626,35 @@ static int awcc_platform_profile_probe(void *drvdata, unsigned long *choices) enum platform_profile_option profile; struct awcc_priv *priv = drvdata; enum awcc_thermal_profile mode; - u8 sys_desc[4]; - u32 first_mode; + u8 id, offset = 0; u32 out_data; int ret; - u8 id; - - ret = awcc_thermal_information(priv->wdev, AWCC_OP_GET_SYSTEM_DESCRIPTION, - 0, (u32 *) &sys_desc); - if (ret < 0) - return ret; - - first_mode = sys_desc[0] + sys_desc[1]; - for (u32 i = 0; i < sys_desc[3]; i++) { - ret = awcc_op_get_resource_id(priv->wdev, i + first_mode, &out_data); + /* + * Thermal profile IDs are listed last at offset + * fan_count + temp_count + unknown_count + */ + for (u32 i = 0; i < ARRAY_SIZE(priv->res_count) - 1; i++) + offset += priv->res_count[i]; + for (u32 i = 0; i < priv->profile_count; i++) { + ret = awcc_op_get_resource_id(priv->wdev, i + offset, &out_data); if (ret == -EIO) return ret; + /* + * Some devices report an incorrect number of thermal profiles + * so the resource ID list may end prematurely + */ if (ret == -EBADRQC) break; /* Some IDs have a BIT(8) flag that should be ignored */ id = FIELD_GET(AWCC_RESOURCE_ID_MASK, out_data); - if (!is_awcc_thermal_profile_id(id)) + if (!is_awcc_thermal_profile_id(id)) { + dev_dbg(&priv->wdev->dev, "Unmapped thermal profile ID 0x%02x\n", id); continue; + } mode = FIELD_GET(AWCC_THERMAL_MODE_MASK, id); profile = awcc_mode_to_platform_profile[mode]; @@ -680,12 +695,27 @@ static int awcc_platform_profile_init(struct wmi_device *wdev) static int alienware_awcc_setup(struct wmi_device *wdev) { struct awcc_priv *priv; + u8 tot = 0; int ret; priv = devm_kzalloc(&wdev->dev, sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; + ret = awcc_thermal_information(wdev, AWCC_OP_GET_SYSTEM_DESCRIPTION, + 0, &priv->system_description); + if (ret < 0) + return ret; + + /* Sanity check */ + for (u32 i = 0; i < ARRAY_SIZE(priv->res_count); i++) { + if (check_add_overflow(tot, priv->res_count[i], &tot)) { + dev_err(&wdev->dev, "Malformed system description: %u\n", + priv->system_description); + return -ENXIO; + } + } + priv->wdev = wdev; dev_set_drvdata(&wdev->dev, priv);
Get and store the AWCC system description in alienware_awcc_setup() instead of awcc_platform_profile_probe() and add a check for integer overflows to avoid misbehaviors. Signed-off-by: Kurt Borja <kuurtb@gmail.com> --- .../platform/x86/dell/alienware-wmi-wmax.c | 56 ++++++++++++++----- 1 file changed, 43 insertions(+), 13 deletions(-)