Re: [PATCH 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Jonathan Cameron <jic23@kernel.org>]

On Sun, 25 Oct 2026 18:03:23 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> asus_acpi_get_sensor_info() iterates through a nested ACPI package
> structure without checking types at either level.  The outer object
> returned by acpi_evaluate_object() and each inner element must be
> validated as ACPI_TYPE_PACKAGE before accessing their package.count
> and package.elements members.
> 
> Add type checks at both levels of the package iteration.
> 
> Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> index 460792ed27e03..81fe1d96365b4 100644
> --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> @@ -57,11 +57,17 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
>  		return -ENODEV;
>  
>  	cpm = buffer.pointer;
> +	if (cpm->type != ACPI_TYPE_PACKAGE) {
> +		kfree(buffer.pointer);
> +		return -EINVAL;
> +	}

Similar to previous for this one. I think we can just used the
typed call to get it in the first place.

>  	for (i = 0; i < cpm->package.count; ++i) {
>  		union acpi_object *elem;
>  		int j;
>  
>  		elem = &cpm->package.elements[i];
> +		if (elem->type != ACPI_TYPE_PACKAGE)
> +			continue;
>  		for (j = 0; j < elem->package.count; ++j) {
>  			union acpi_object *sub_elem;
Whilst here the ACPI_FREE() thing probably applies as it did
in the previous patch.

Jonathan

>