[PATCH] drm/nouveau/disp/r535: validate ACPI backlight DSM return type

[PATCH] drm/nouveau/disp/r535: validate ACPI backlight DSM return type

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

r535_disp_oneinit() evaluates ACPI _DSM method 0x14 for backlight data
and directly accesses obj->package.count and obj->package.elements
without first verifying that the returned ACPI object is actually a
package. If firmware returns an unexpected type (integer, string,
buffer), the union access reads unrelated fields, causing undefined
behavior.

Additionally, the loop accesses each element as integer.value without
checking that the element is actually ACPI_TYPE_INTEGER, and copies
into the fixed-size backLightData array without bounds checking, which
can overflow when firmware returns more elements than expected.

Add type validation:

1. Check obj->type == ACPI_TYPE_PACKAGE before accessing package fields.
2. Free the ACPI object when the type is unexpected.
3. Validate each element is ACPI_TYPE_INTEGER before accessing its value.
4. Check that the cumulative copy size does not exceed the destination
   array.

When a non-integer child or oversized element is encountered, the loop
breaks and the valid prefix is forwarded. This preserves the existing
behavior of reporting success for the _DSM call while preventing
out-of-bounds access.

Fixes: 9e99444490238d ("drm/nouveau/disp/r535: initial support")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
index f5f22173fc2c1..267cc098ff769 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
@@ -1556,15 +1556,21 @@ r535_disp_oneinit(struct nvkm_disp *disp)
 								0x00000102, 0x14, &argv4);
 					if (!obj) {
 						acpi_handle_info(handle, "failed to evaluate _DSM\n");
-					} else {
+					} else if (obj->type == ACPI_TYPE_PACKAGE) {
 						for (int i = 0; i < obj->package.count; i++) {
 							union acpi_object *elt = &obj->package.elements[i];
 							u32 size;
 
+							if (elt->type != ACPI_TYPE_INTEGER)
+								break;
+
 							if (elt->integer.value & ~0xffffffffULL)
 								size = 8;
 							else
 								size = 4;
+							if (ctrl->backLightDataSize + size >
+							    sizeof(ctrl->backLightData))
+								break;
 
 							memcpy(&ctrl->backLightData[ctrl->backLightDataSize], &elt->integer.value, size);
 							ctrl->backLightDataSize += size;
@@ -1572,6 +1578,8 @@ r535_disp_oneinit(struct nvkm_disp *disp)
 
 						ctrl->status = 0;
 						ACPI_FREE(obj);
+					} else {
+						ACPI_FREE(obj);
 					}
 
 					kfree(argv4.buffer.pointer);
-- 
2.47.3