[PATCH 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[PATCH 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Tristan Madani]

cm32181_acpi_get_cpm() accesses cpm->package.count and
cpm->package.elements without checking that the returned ACPI object
is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
the package union members alias onto unrelated data.

Add the missing type check after the ACPI evaluation and before
accessing the package contents.

Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/light/cm32181.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index b32a94028f091..1528465be6adb 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -121,6 +121,11 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
 	}
 
 	cpm = buffer.pointer;
+	if (cpm->type != ACPI_TYPE_PACKAGE) {
+		dev_err(dev, "object %s is not a package\n", obj_name);
+		kfree(buffer.pointer);
+		return -EINVAL;
+	}
 	if (cpm->package.count > count)
 		dev_warn(dev, "%s table contains %u values, only using first %d values\n",
 			 obj_name, cpm->package.count, count);
-- 
2.47.3

[PATCH 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Tristan Madani]

asus_acpi_get_sensor_info() iterates through a nested ACPI package
structure without checking types at either level.  The outer object
returned by acpi_evaluate_object() and each inner element must be
validated as ACPI_TYPE_PACKAGE before accessing their package.count
and package.elements members.

Add type checks at both levels of the package iteration.

Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index 460792ed27e03..81fe1d96365b4 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -57,11 +57,17 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		return -ENODEV;
 
 	cpm = buffer.pointer;
+	if (cpm->type != ACPI_TYPE_PACKAGE) {
+		kfree(buffer.pointer);
+		return -EINVAL;
+	}
 	for (i = 0; i < cpm->package.count; ++i) {
 		union acpi_object *elem;
 		int j;
 
 		elem = &cpm->package.elements[i];
+		if (elem->type != ACPI_TYPE_PACKAGE)
+			continue;
 		for (j = 0; j < elem->package.count; ++j) {
 			union acpi_object *sub_elem;
 
-- 
2.47.3

Re: [PATCH 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Jonathan Cameron]

On Sun, 25 Oct 2026 18:03:23 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> asus_acpi_get_sensor_info() iterates through a nested ACPI package
> structure without checking types at either level.  The outer object
> returned by acpi_evaluate_object() and each inner element must be
> validated as ACPI_TYPE_PACKAGE before accessing their package.count
> and package.elements members.
> 
> Add type checks at both levels of the package iteration.
> 
> Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> index 460792ed27e03..81fe1d96365b4 100644
> --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> @@ -57,11 +57,17 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
>  		return -ENODEV;
>  
>  	cpm = buffer.pointer;
> +	if (cpm->type != ACPI_TYPE_PACKAGE) {
> +		kfree(buffer.pointer);
> +		return -EINVAL;
> +	}

Similar to previous for this one. I think we can just used the
typed call to get it in the first place.

>  	for (i = 0; i < cpm->package.count; ++i) {
>  		union acpi_object *elem;
>  		int j;
>  
>  		elem = &cpm->package.elements[i];
> +		if (elem->type != ACPI_TYPE_PACKAGE)
> +			continue;
>  		for (j = 0; j < elem->package.count; ++j) {
>  			union acpi_object *sub_elem;
Whilst here the ACPI_FREE() thing probably applies as it did
in the previous patch.

Jonathan

>  

Re: [PATCH 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron]

On Sun, 25 Oct 2026 18:03:22 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Add the missing type check after the ACPI evaluation and before
> accessing the package contents.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Can we use acpi_evaluate_object_typed() so that we failure the
earlier call?

Whilst we are here can we also swap the kfree() for ACPI_FREE().

Jonathan


> ---
>  drivers/iio/light/cm32181.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index b32a94028f091..1528465be6adb 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -121,6 +121,11 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	}
>  
>  	cpm = buffer.pointer;
> +	if (cpm->type != ACPI_TYPE_PACKAGE) {
> +		dev_err(dev, "object %s is not a package\n", obj_name);
> +		kfree(buffer.pointer);
> +		return -EINVAL;
> +	}
>  	if (cpm->package.count > count)
>  		dev_warn(dev, "%s table contains %u values, only using first %d values\n",
>  			 obj_name, cpm->package.count, count);