Patch "platform/x86: wmi: Break possible infinite loop when parsing GUID" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    platform/x86: wmi: Break possible infinite loop when parsing GUID

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     platform-x86-wmi-break-possible-infinite-loop-when-p.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0933ab92bd2131f9808f5c3297b0767d3cb65a9b
Author: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
Date:   Wed Jun 21 18:11:54 2023 +0300

    platform/x86: wmi: Break possible infinite loop when parsing GUID
    
    [ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
    
    The while-loop may break on one of the two conditions, either ID string
    is empty or GUID matches. The second one, may never be reached if the
    parsed string is not correct GUID. In such a case the loop will never
    advance to check the next ID.
    
    Break possible infinite loop by factoring out guid_parse_and_compare()
    helper which may be moved to the generic header for everyone later on
    and preventing from similar mistake in the future.
    
    Interestingly that firstly it appeared when WMI was turned into a bus
    driver, but later when duplicated GUIDs were checked, the while-loop
    has been replaced by for-loop and hence no mistake made again.
    
    Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
    Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@xxxxxxxxxxxxxxx
    Tested-by: Armin Wolf <W_Armin@xxxxxx>
    Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 5e4c03f7db7c0..567c28705cb1b 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -130,6 +130,16 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
 	return false;
 }
 
+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
+{
+	guid_t guid_input;
+
+	if (guid_parse(string, &guid_input))
+		return false;
+
+	return guid_equal(&guid_input, guid);
+}
+
 static const void *find_guid_context(struct wmi_block *wblock,
 				      struct wmi_driver *wdriver)
 {
@@ -142,11 +152,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
 
 	id = wdriver->id_table;
 	while (*id->guid_string) {
-		guid_t guid_input;
-
-		if (guid_parse(id->guid_string, &guid_input))
-			continue;
-		if (guid_equal(&wblock->gblock.guid, &guid_input))
+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
 			return id->context;
 		id++;
 	}
@@ -804,11 +810,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 		return 0;
 
 	while (*id->guid_string) {
-		guid_t driver_guid;
-
-		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
-			continue;
-		if (guid_equal(&driver_guid, &wblock->gblock.guid))
+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
 			return 1;
 
 		id++;