From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0EDB3033D6 for ; Wed, 8 Jul 2026 11:36:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783510602; cv=none; b=Udc3+396XiOUrCGUv7WGAkF657iFVGt1afLxq43qQBTAnPoIqQRWExwjua19mgb1Yg4aOnpWvc0juzKj/fdqmE9ZlA7NhMjE92tTHDoW+2wZTYYPUPDLsXqODNf33CCie+BouB8Vp1kuw8CfyzrfK/JclhS7q5rtzwLTa9Qy/lM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783510602; c=relaxed/simple; bh=IbjpZOam2hI9dpzZIJY7qG5MjnJ8WSt8d2P/o3d7CJU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Z7QQHMPu+AISBTZEIxcJq5gBHd364SOQJiVJEur3/ApnHeyFn1EYLeJOlm2d1Sx6eJOYti3tkpItPhiRXh1+u/yBCuUdLvTl8YwDdcAGUlyXflYRcJ8vMWdjSFE31y7tC+umqR3YNy3A7q+1YG2XPHx+PWnkVuMUJd0CQOiuhHY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iRaOD5E+; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iRaOD5E+" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cc6dd436c6so5718835ad.2 for ; Wed, 08 Jul 2026 04:36:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783510601; x=1784115401; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=WZvxbMgMRY8vlx4bL3xwkM6A6vN75hNfiS9LW8iggcI=; b=iRaOD5E+dyQxc73OOD+r0RsHv5eDSOUjn+diwr9WzaFCHhsGcsg+DiCyEKDwEeBp31 GWru5FsNa6SdNegBS58jMTjGCbPXuf4ocF7TLF5fiKcpG/BqCnF/dyEJAOlpuQblvzBY 145eN5MSaCiEp3hdBMNSo9QMRLo0Hhn557ZpMsHyx1j602r1HhARerOiSevZpceyaCc6 1KngxWoN3yk5VNSdex4pQxgd/E8HnNBKY57W+y2pE4q32wh2oyiYd+r4MIJyJsOk9bca APSAJkWB/DXbTvh1Ap7iCFKwPXxnshDY9HjOQ4Mg2IwdnVYoKaLQH5CZDN1r+VahzCAA gChw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783510601; x=1784115401; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WZvxbMgMRY8vlx4bL3xwkM6A6vN75hNfiS9LW8iggcI=; b=p25OeqG9gwiCBaYeWF59oUqSMd4QvANTNo5GBuXHb6tbKPm9Qf+2R6HSnelwZ4z8Ay SCXZ8oZ2PwY9IIt6yBklpFlIjTTGWbf+8UNBsVzjRg82ZMY4jHi7MJP3sjYwlcyhdRYx rXb6tVYsVIN000rFwJ75Dprl3b+071jKYPE2C9T0Zvvk1z3kCeutCjzPDcYGZS2u+QjP W0GqHCPFixffSMwNMBcc+pqiJV5Wpefz+0+eWpwINeAZUxHLUMicTC4GvRVPWR8TJ9xx syi2E5Wc0GvSBfQStmqT+W74xDxTUPfH43UUTj++bbrRjj8QwA7FzCTRooqfqu0tvvzl TLjw== X-Forwarded-Encrypted: i=1; AHgh+Rp1L8/rzSdp/ka9eju0Oz6wE6FTpBqGyWK+J7LHi8B0DpDI62FTgg2j0xIs+1zHB5qe/h0p/vcOxvq8yIE=@vger.kernel.org X-Gm-Message-State: AOJu0YxbMuYGZUru83rJctxzKz2swZUk2Aevd+rIWkzz5FbtKyBUHvl2 3/+hTHG8mH5NmvJaZfEJ4ZM7eSclWkcyJBZCu/H13Lm8i0/GYJeFW5w9 X-Gm-Gg: AfdE7cnJSwdN72mVOWSHy4gP/vXWn8ttSzkPjK8sRowcXbXeNbLbj0kwhPQpv2gUwTt /6sqdvL2XbkUH+fnTsm+JdvP6y2flknqLf7xJiccOlFI5bq8N2uAzlzafv+SZyUHrsbtVChSZCC qr9tudCwgLA+d8T57Vra2oQmYSvo/sg4CrXKOpBoOJHz4iGPyj53t+W10+32vGbWrB/UI3k+iJ6 jvkFBcrOWbrUbXJGdNQzJXU5SjKdMJn1zv0vtSaNkNYM6Q+3ggSDuUS2bZdD7ioWhWsaxhZYZcf ZiRg0NItDRJN9tu6BTCkl7LNB97tDBEIFJA63ekX0xxLM5m23dFYx4WqcP2wlbL2ZVVj2MBwUiS uXaP1+Q1/CaeXVMQAW3uAebYjQABM3ZaBmZT1jQ26cq7cK/jcsNriQ17o8ln78XcfGuzuYRBfQD 9WYSTBjesefoLq X-Received: by 2002:a17:902:e950:b0:2c9:c517:d070 with SMTP id d9443c01a7336-2ccea371d01mr20348835ad.3.1783510600782; Wed, 08 Jul 2026 04:36:40 -0700 (PDT) Received: from lgs.. ([152.32.188.52]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bf7858sm26950825ad.23.2026.07.08.04.36.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 04:36:40 -0700 (PDT) From: Guangshuo Li To: David Rhodes , Richard Fitzgerald , Jaroslav Kysela , Takashi Iwai , Stefan Binding , linux-sound@vger.kernel.org, patches@opensource.cirrus.com, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] ALSA: hda: cs35l41: validate and free ACPI mute object Date: Wed, 8 Jul 2026 19:36:25 +0800 Message-ID: <20260708113625.752913-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cs35l41_get_acpi_mute_state() evaluates a _DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the caller and is never freed after use, so each successful query leaks the _DSM result object. The code also assumes that the returned object is a buffer with at least one byte. A malformed firmware response can return a different object type or an empty buffer, and the direct ret->buffer.pointer dereference can then access an invalid pointer. Use the typed _DSM helper, validate that the returned buffer contains at least one byte, and free the ACPI object after reading it. Fixes: 447106e92a0c ("ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA") Signed-off-by: Guangshuo Li --- sound/hda/codecs/side-codecs/cs35l41_hda.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sound/hda/codecs/side-codecs/cs35l41_hda.c b/sound/hda/codecs/side-codecs/cs35l41_hda.c index 64a5bd895fd1..237059ef22f5 100644 --- a/sound/hda/codecs/side-codecs/cs35l41_hda.c +++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c @@ -1434,10 +1434,19 @@ static int cs35l41_get_acpi_mute_state(struct cs35l41_hda *cs35l41, acpi_handle guid_parse(CS35L41_UUID, &guid); if (cs35l41_dsm_supported(handle, CS35L41_DSM_GET_MUTE)) { - ret = acpi_evaluate_dsm(handle, &guid, 0, CS35L41_DSM_GET_MUTE, NULL); + ret = acpi_evaluate_dsm_typed(handle, &guid, 0, + CS35L41_DSM_GET_MUTE, NULL, + ACPI_TYPE_BUFFER); + if (!ret) return -EINVAL; + if (!ret->buffer.length || !ret->buffer.pointer) { + ACPI_FREE(ret); + return -EINVAL; + } + mute = *ret->buffer.pointer; + ACPI_FREE(ret); dev_dbg(cs35l41->dev, "CS35L41_DSM_GET_MUTE: %d\n", mute); } -- 2.43.0