[PATCH v2 0/2] iio: validate ACPI object types before package access

[PATCH v2 0/2] iio: validate ACPI object types before package access

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Two IIO drivers access ACPI package members without validating the
returned object type.  Use acpi_evaluate_object_typed() to request
ACPI_TYPE_PACKAGE at evaluation time, and replace kfree() with
ACPI_FREE() for ACPI-allocated buffers.

Changes in v2:
- Use acpi_evaluate_object_typed() instead of manual post-eval type
  check, as suggested by Jonathan Cameron
- Replace kfree() with ACPI_FREE() for ACPI-allocated buffers

Tristan Madani (2):
  iio: light: cm32181: validate ACPI object type in
    cm32181_acpi_get_cpm()
  iio: imu: inv_mpu6050: validate ACPI object types in
    asus_acpi_get_sensor_info()

 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 7 +++++--
 drivers/iio/light/cm32181.c                | 5 +++--
 2 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.47.3

[PATCH v2 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

cm32181_acpi_get_cpm() accesses cpm->package.count and
cpm->package.elements without checking that the returned ACPI object
is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
the package union members alias onto unrelated data.

Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
directly, so the ACPI core validates the type before returning.
Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.

Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/light/cm32181.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index b32a94028f091e..8d00486af608c9 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -114,7 +114,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
 	if (!handle)
 		return -ENODEV;
 
-	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
+	status = acpi_evaluate_object_typed(handle, obj_name, NULL, &buffer,
+						ACPI_TYPE_PACKAGE);
 	if (ACPI_FAILURE(status)) {
 		dev_err(dev, "object %s not found\n", obj_name);
 		return -ENODEV;
@@ -131,7 +132,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
 		values[i] = elem->integer.value;
 	}
 
-	kfree(buffer.pointer);
+	ACPI_FREE(buffer.pointer);
 
 	return count;
 }
-- 
2.47.3

[PATCH v2 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

asus_acpi_get_sensor_info() iterates through a nested ACPI package
structure without checking types at either level.  The outer object
returned by acpi_evaluate_object() and each inner element must be
validated as ACPI_TYPE_PACKAGE before accessing their package.count
and package.elements members.

Use acpi_evaluate_object_typed() to validate the outer object type
at evaluation time.  Add a type check for each inner element before
accessing its package contents.  Also replace kfree() with
ACPI_FREE() for the ACPI-allocated buffer.

Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index 460792ed27e031..e5ffa0d5f6b1a2 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -52,7 +52,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 	union acpi_object *cpm;
 	int ret;
 
-	status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);
+	status = acpi_evaluate_object_typed(adev->handle, "CNF0", NULL,
+						&buffer, ACPI_TYPE_PACKAGE);
 	if (ACPI_FAILURE(status))
 		return -ENODEV;
 
@@ -62,6 +63,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		int j;
 
 		elem = &cpm->package.elements[i];
+		if (elem->type != ACPI_TYPE_PACKAGE)
+			continue;
 		for (j = 0; j < elem->package.count; ++j) {
 			union acpi_object *sub_elem;
 
@@ -78,7 +81,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		}
 	}
 	ret = cpm->package.count;
-	kfree(buffer.pointer);
+	ACPI_FREE(buffer.pointer);
 
 	return ret;
 }
-- 
2.47.3

Re: [PATCH v2 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron]

On Mon, 26 Oct 2026 14:20:38 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
> directly, so the ACPI core validates the type before returning.
> Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/iio/light/cm32181.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index b32a94028f091e..8d00486af608c9 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -114,7 +114,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	if (!handle)
>  		return -ENODEV;
>  
> -	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
> +	status = acpi_evaluate_object_typed(handle, obj_name, NULL, &buffer,
> +						ACPI_TYPE_PACKAGE);
The parameter on the second line should be aligned as:
	status = acpi_evaluate_object_typed(handle, obj_name, NULL, &buffer,
					    ACPI_TYPE_PACKAGE);

Along with being preferred style for kernel code I think it is also the
most common choice in this file.

>  	if (ACPI_FAILURE(status)) {
>  		dev_err(dev, "object %s not found\n", obj_name);
>  		return -ENODEV;
> @@ -131,7 +132,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  		values[i] = elem->integer.value;
>  	}
>  
> -	kfree(buffer.pointer);
> +	ACPI_FREE(buffer.pointer);
>  
>  	return count;
>  }

Re: [PATCH v2 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Jonathan Cameron]

On Mon, 26 Oct 2026 14:20:39 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> asus_acpi_get_sensor_info() iterates through a nested ACPI package
> structure without checking types at either level.  The outer object
> returned by acpi_evaluate_object() and each inner element must be
> validated as ACPI_TYPE_PACKAGE before accessing their package.count
> and package.elements members.
> 
> Use acpi_evaluate_object_typed() to validate the outer object type
> at evaluation time.  Add a type check for each inner element before
> accessing its package contents.  Also replace kfree() with
> ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> index 460792ed27e031..e5ffa0d5f6b1a2 100644
> --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
> @@ -52,7 +52,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
>  	union acpi_object *cpm;
>  	int ret;
>  
> -	status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);
> +	status = acpi_evaluate_object_typed(adev->handle, "CNF0", NULL,
> +						&buffer, ACPI_TYPE_PACKAGE);
Same as previous wrt to indent.  In the kernel style guide
this is only there implicitly in examples, but it is definitely
preferred choice for IIO and I don't recall seeing anywhere in
the kernel where this wasn't an acceptable choice.

Jonathan


>  	if (ACPI_FAILURE(status))
>  		return -ENODEV;
>  
> @@ -62,6 +63,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
>  		int j;
>  
>  		elem = &cpm->package.elements[i];
> +		if (elem->type != ACPI_TYPE_PACKAGE)
> +			continue;
>  		for (j = 0; j < elem->package.count; ++j) {
>  			union acpi_object *sub_elem;
>  
> @@ -78,7 +81,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
>  		}
>  	}
>  	ret = cpm->package.count;
> -	kfree(buffer.pointer);
> +	ACPI_FREE(buffer.pointer);
>  
>  	return ret;
>  }

[PATCH v3 0/2] iio: validate ACPI return types in sensor drivers

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Two IIO drivers access ACPI package members without type validation.
Use acpi_evaluate_object_typed() for the outer object and add inner
element type checks where needed.

Changes in v3:
- Fix alignment of acpi_evaluate_object_typed() continuation line to
  match the opening parenthesis, per Jonathan Cameron

Changes in v2:
- Switch from post-hoc type check to acpi_evaluate_object_typed()
- Replace kfree() with ACPI_FREE() for ACPI-allocated buffers

Tristan Madani (2):
  iio: light: cm32181: validate ACPI object type in
    cm32181_acpi_get_cpm()
  iio: imu: inv_mpu6050: validate ACPI object types in
    asus_acpi_get_sensor_info()

 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 7 +++++--
 drivers/iio/light/cm32181.c                | 5 +++--
 2 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.47.3

[PATCH v3 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

cm32181_acpi_get_cpm() accesses cpm->package.count and
cpm->package.elements without checking that the returned ACPI object
is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
the package union members alias onto unrelated data.

Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
directly, so the ACPI core validates the type before returning.
Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.

Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/light/cm32181.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index 9df85b3999fa8..a16fc83bcbb08 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -115,7 +115,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
 	if (!handle)
 		return -ENODEV;
 
-	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
+	status = acpi_evaluate_object_typed(handle, obj_name, NULL,
+					    &buffer, ACPI_TYPE_PACKAGE);
 	if (ACPI_FAILURE(status)) {
 		dev_err(dev, "object %s not found\n", obj_name);
 		return -ENODEV;
@@ -132,7 +133,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
 		values[i] = elem->integer.value;
 	}
 
-	kfree(buffer.pointer);
+	ACPI_FREE(buffer.pointer);
 
 	return count;
 }
-- 
2.47.3

[PATCH v3 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

asus_acpi_get_sensor_info() iterates through a nested ACPI package
structure without checking types at either level.  The outer object
returned by acpi_evaluate_object() and each inner element must be
validated as ACPI_TYPE_PACKAGE before accessing their package.count
and package.elements members.

Use acpi_evaluate_object_typed() to validate the outer object type
at evaluation time.  Add a type check for each inner element before
accessing its package contents.  Also replace kfree() with
ACPI_FREE() for the ACPI-allocated buffer.

Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index f7bce428d9eb4..e6a4de4fbffd2 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -50,7 +50,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 	union acpi_object *cpm;
 	int ret;
 
-	status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);
+	status = acpi_evaluate_object_typed(adev->handle, "CNF0", NULL,
+					    &buffer, ACPI_TYPE_PACKAGE);
 	if (ACPI_FAILURE(status))
 		return -ENODEV;
 
@@ -60,6 +61,8 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		int j;
 
 		elem = &cpm->package.elements[i];
+		if (elem->type != ACPI_TYPE_PACKAGE)
+			continue;
 		for (j = 0; j < elem->package.count; ++j) {
 			union acpi_object *sub_elem;
 
@@ -76,7 +79,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		}
 	}
 	ret = cpm->package.count;
-	kfree(buffer.pointer);
+	ACPI_FREE(buffer.pointer);
 
 	return ret;
 }
-- 
2.47.3

Re: [PATCH v3 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron]

On Thu, 29 Oct 2026 11:08:28 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
> directly, so the ACPI core validates the type before returning.
> Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
The threading is broken here.  They are in reply to previous version
which is always a bad idea and not threaded below the cover letter.

Hopefully I picked up the right code.  Applied, but not rushed
so on the testing branch of iio.git.  These are hardening patches
against broken firmware rather than fixes, so I've also dropped
that marking and the +CC stable.

Hardening this stuff is good to have though when it doesn't
add much complexity like this patch.

Thanks,

Jonathan


> ---
>  drivers/iio/light/cm32181.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index 9df85b3999fa8..a16fc83bcbb08 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -115,7 +115,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	if (!handle)
>  		return -ENODEV;
>  
> -	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
> +	status = acpi_evaluate_object_typed(handle, obj_name, NULL,
> +					    &buffer, ACPI_TYPE_PACKAGE);
>  	if (ACPI_FAILURE(status)) {
>  		dev_err(dev, "object %s not found\n", obj_name);
>  		return -ENODEV;
> @@ -132,7 +133,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  		values[i] = elem->integer.value;
>  	}
>  
> -	kfree(buffer.pointer);
> +	ACPI_FREE(buffer.pointer);
>  
>  	return count;
>  }

Re: [PATCH v3 2/2] iio: imu: inv_mpu6050: validate ACPI object types in asus_acpi_get_sensor_info()

[Jonathan Cameron]

On Thu, 29 Oct 2026 11:08:29 +0000
Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> asus_acpi_get_sensor_info() iterates through a nested ACPI package
> structure without checking types at either level.  The outer object
> returned by acpi_evaluate_object() and each inner element must be
> validated as ACPI_TYPE_PACKAGE before accessing their package.count
> and package.elements members.
> 
> Use acpi_evaluate_object_typed() to validate the outer object type
> at evaluation time.  Add a type check for each inner element before
> accessing its package contents.  Also replace kfree() with
> ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
> Cc: stable@vger.kernel.org
As with the previous.  Hardening against buggy firmware isn't
a fix. It is however nice to have so with those tags dropped
I've applied this to the testing branch of iio.git

Thanks,

Jonathan