[PATCH 1/1] PCI/TPH: Validate the firmware Steering Tag response

[PATCH 1/1] PCI/TPH: Validate the firmware Steering Tag response

[Wei Huang]

TPH _DSM returns an eight-byte Steering Tag information buffer.
Checking only the ACPI object type allows a short firmware response
to be read beyond the end of its buffer.

For safety, require a non-NULL buffer containing the complete value
before copying it. Use memcpy() so that reading the response does not
depend on the alignment of the firmware buffer.

Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support")
Signed-off-by: Wei Huang <wei.huang2@amd.com>
---
 drivers/pci/tph.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
index 655ffd60e62f..4d064b86befc 100644
--- a/drivers/pci/tph.c
+++ b/drivers/pci/tph.c
@@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid,
 	if (!out_obj)
 		return AE_ERROR;
 
-	if (out_obj->type != ACPI_TYPE_BUFFER) {
+	if (out_obj->type != ACPI_TYPE_BUFFER ||
+	    out_obj->buffer.length < sizeof(st_out->value) ||
+	    !out_obj->buffer.pointer) {
 		ACPI_FREE(out_obj);
 		return AE_ERROR;
 	}
 
-	st_out->value = *((u64 *)(out_obj->buffer.pointer));
+	memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value));
 
 	ACPI_FREE(out_obj);
 
-- 
2.55.0

Re: [PATCH 1/1] PCI/TPH: Validate the firmware Steering Tag response

[Bjorn Helgaas]

On Thu, Sep 24, 2026 at 02:05:43PM -0500, Wei Huang wrote:
> TPH _DSM returns an eight-byte Steering Tag information buffer.
> Checking only the ACPI object type allows a short firmware response
> to be read beyond the end of its buffer.
> 
> For safety, require a non-NULL buffer containing the complete value
> before copying it. Use memcpy() so that reading the response does not
> depend on the alignment of the firmware buffer.
> 
> Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support")
> Signed-off-by: Wei Huang <wei.huang2@amd.com>

Applied to pci/tph for v7.4, thanks!

> ---
>  drivers/pci/tph.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
> index 655ffd60e62f..4d064b86befc 100644
> --- a/drivers/pci/tph.c
> +++ b/drivers/pci/tph.c
> @@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid,
>  	if (!out_obj)
>  		return AE_ERROR;
>  
> -	if (out_obj->type != ACPI_TYPE_BUFFER) {
> +	if (out_obj->type != ACPI_TYPE_BUFFER ||
> +	    out_obj->buffer.length < sizeof(st_out->value) ||
> +	    !out_obj->buffer.pointer) {
>  		ACPI_FREE(out_obj);
>  		return AE_ERROR;
>  	}
>  
> -	st_out->value = *((u64 *)(out_obj->buffer.pointer));
> +	memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value));
>  
>  	ACPI_FREE(out_obj);
>  
> -- 
> 2.55.0
>