From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 347BF4183DE; Wed, 10 Jun 2026 15:42:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.21.23.139 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781106147; cv=none; b=ArZoF5f5SVRxS5CzaoAQB919s5CBZa0WOAk3pkqMGf5mfzutpQ3eBxDoQBoUIHvJR01A/5w7OHS4MAIS3XuPZGgRUw1SZnzz9nzy8r7cFq5967qYp5g8B5agenApOnKD1mZbOz+k8QRXFlrR0r5OzhSXeA9LxkVugdoEmKjf1mM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781106147; c=relaxed/simple; bh=Q43iKv+bRAYvDzMXpVYT3u65R0lwEyJOxcTRepBWI3A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bG0OIN5rgNQLvc8y+62kBchJYA162+bXp54nCC5beo50a9JH9yY/+Zh7o+laqR//4gH7u/5w7oZElnR/GDdHPxumVStecfN/FUNVtum1vh4nrjsafnfoo4nLZZ29g9TKu3tsnd33QLjz133ZvQsuctKJD1+QPi5zwynRbxhTa2U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org; spf=pass smtp.mailfrom=disroot.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b=i73Y9Co7; arc=none smtp.client-ip=178.21.23.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=disroot.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b="i73Y9Co7" Received: from mail01.disroot.lan (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id D63B926597; Wed, 10 Jun 2026 17:42:24 +0200 (CEST) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id M_sjUvGvzZ9a; Wed, 10 Jun 2026 17:42:24 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1781106144; bh=Q43iKv+bRAYvDzMXpVYT3u65R0lwEyJOxcTRepBWI3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=i73Y9Co7gndhSOPpeVLPio+u0mCjjagnLqlV3VBIH4/7pRya+f/gQ/aIIMRZ6yh5X MbKGyQLa6WTUK1jAZG0Po1rKdf/pIMjitCj5XpfWe1DZ91duJntrE2Nqm58W9kwo8L B1ldmaGQqzMFPyAvr/GCe0bkoDYchuBenkA6FAqnZwhLNF/8f4bWnY8+ZxkCKEDjEt m40eC/aT8GrUPXh5YrsGIkJuqLIH3HDR3l566c4xcMsI2RQtRwUGe0EKDveSBvxUTt 5CJyxOD1PX6RFn9nQG7RKObqPYFZE7+Ul62LUXtt1kuvRh9Hy55yEOYvhY6qSIBNmq p1eO82Sc/ke/A== From: Marco Scardovi To: Mika Westerberg , Andy Shevchenko , Linus Walleij , Bartosz Golaszewski Cc: linux-gpio@vger.kernel.org, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v6 1/2] gpiolib: acpi: Add robust bounds-checking for GPIO pin resources Date: Wed, 10 Jun 2026 17:42:03 +0200 Message-ID: <20260610154204.110379-2-scardracs@disroot.org> In-Reply-To: <20260610154204.110379-1-scardracs@disroot.org> References: <20260610154204.110379-1-scardracs@disroot.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Ensure that GPIO pin resource arrays are safely bounded before accessing indices. Add explicit bounds checking in acpi_request_own_gpiod(), acpi_gpio_irq_is_wake(), and acpi_gpiochip_alloc_event() to prevent out-of-bounds array reads if the ACPI namespace provides malformed or empty pin tables. This change addresses potential safety issues arising from inconsistent or invalid ACPI pin tables. It does not alter functional behavior in well-formed tables. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi --- drivers/gpio/gpiolib-acpi-core.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c index 1a762a2988b7..b09f89832890 100644 --- a/drivers/gpio/gpiolib-acpi-core.c +++ b/drivers/gpio/gpiolib-acpi-core.c @@ -316,10 +316,17 @@ static struct gpio_desc *acpi_request_own_gpiod(struct gpio_chip *chip, unsigned int index, const char *label) { - int polarity = GPIO_ACTIVE_HIGH; - enum gpiod_flags flags = acpi_gpio_to_gpiod_flags(agpio, polarity); - unsigned int pin = agpio->pin_table[index]; + enum gpiod_flags flags; struct gpio_desc *desc; + unsigned int pin; + int polarity; + + if (index >= agpio->pin_table_length) + return ERR_PTR(-EINVAL); + + pin = agpio->pin_table[index]; + polarity = GPIO_ACTIVE_HIGH; + flags = acpi_gpio_to_gpiod_flags(agpio, polarity); desc = gpiochip_request_own_desc(chip, pin, label, polarity, flags); if (IS_ERR(desc)) @@ -333,7 +340,12 @@ static struct gpio_desc *acpi_request_own_gpiod(struct gpio_chip *chip, static bool acpi_gpio_irq_is_wake(struct device *parent, const struct acpi_resource_gpio *agpio) { - unsigned int pin = agpio->pin_table[0]; + unsigned int pin; + + if (agpio->pin_table_length == 0) + return false; + + pin = agpio->pin_table[0]; if (agpio->wake_capable != ACPI_WAKE_CAPABLE) return false; @@ -363,6 +375,9 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, if (!acpi_gpio_get_irq_resource(ares, &agpio)) return AE_OK; + if (agpio->pin_table_length == 0) + return AE_OK; + handle = ACPI_HANDLE(chip->parent); pin = agpio->pin_table[0]; -- 2.54.0