Re: [PATCH v2 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron <jic23@kernel.org>]

On Mon, 26 Oct 2026 14:20:38 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
> directly, so the ACPI core validates the type before returning.
> Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/iio/light/cm32181.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index b32a94028f091e..8d00486af608c9 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -114,7 +114,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	if (!handle)
>  		return -ENODEV;
>  
> -	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
> +	status = acpi_evaluate_object_typed(handle, obj_name, NULL, &buffer,
> +						ACPI_TYPE_PACKAGE);
The parameter on the second line should be aligned as:
	status = acpi_evaluate_object_typed(handle, obj_name, NULL, &buffer,
					    ACPI_TYPE_PACKAGE);

Along with being preferred style for kernel code I think it is also the
most common choice in this file.

>  	if (ACPI_FAILURE(status)) {
>  		dev_err(dev, "object %s not found\n", obj_name);
>  		return -ENODEV;
> @@ -131,7 +132,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  		values[i] = elem->integer.value;
>  	}
>  
> -	kfree(buffer.pointer);
> +	ACPI_FREE(buffer.pointer);
>  
>  	return count;
>  }