[PATCH] media: atomisp: reject short _DSM packages

[PATCH] media: atomisp: reject short _DSM packages

[Kang Chen]

gmin_get_config_dsm_var() walks the package returned by the atomisp
_DSM function, but it does not reject packages with fewer than two
elements.  count is unsigned, so an empty package makes count - 1
evaluate to UINT_MAX and the loop walks far past the end of the
elements array, reading unrelated memory.

Require at least two elements before scanning the key/value pairs.

Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
index d628fe4dca6d..159b72c1eb40 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
@@ -1167,6 +1167,13 @@ static int gmin_get_config_dsm_var(struct device *dev,
 		return -EINVAL;
 	}
 
+	if (obj->package.count < 2) {
+		dev_info(dev, "Invalid _DSM package count %u\n",
+			 obj->package.count);
+		ACPI_FREE(obj);
+		return -EINVAL;
+	}
+
 #if 0 /* Just for debugging purposes */
 	for (i = 0; i < obj->package.count; i++) {
 		union acpi_object *cur = &obj->package.elements[i];
-- 
2.34.1

Re: [PATCH] media: atomisp: reject short _DSM packages

[Andy Shevchenko]

On Tue, Nov 03, 2026 at 07:41:21PM +0800, Kang Chen wrote:
> gmin_get_config_dsm_var() walks the package returned by the atomisp
> _DSM function, but it does not reject packages with fewer than two
> elements.  count is unsigned, so an empty package makes count - 1
> evaluate to UINT_MAX and the loop walks far past the end of the
> elements array, reading unrelated memory.
> 
> Require at least two elements before scanning the key/value pairs.

Stop being a meat proxy to AI. Read the code.
NAK.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] media: atomisp: reject short _DSM packages

[Dan Carpenter]

On Tue, Nov 03, 2026 at 07:41:21PM +0800, Kang Chen wrote:
> gmin_get_config_dsm_var() walks the package returned by the atomisp
> _DSM function, but it does not reject packages with fewer than two
> elements.  count is unsigned, so an empty package makes count - 1
> evaluate to UINT_MAX and the loop walks far past the end of the
> elements array, reading unrelated memory.
> 
> Require at least two elements before scanning the key/value pairs.
> 
> Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
> ---

Surely, the infromation from ACPI is trusted?

regards,
dan carpenter

Re: 回复：[PATCH] media: atomisp: reject short _DSM packages

[Greg Kroah-Hartman]

On Tue, Nov 03, 2026 at 09:13:16PM +0800, Kang Chen wrote:
> No. In the confidential computing (CVM) threat model, ACPI tables are
> controlled by the host and are untrusted; BadAML (CCS'25) shows malicious
> ACPI/AML can be used to attack the guest. 
> And the kernel already validates many ACPI return values
> (e.g. types, package counts, bounds).

Are you sure that Linux supports that threat model at this point in
time?  And that this matters for this specific driver?  I doubt that
this media driver would ever be seriously considered for those types of
situations :)

thanks,

greg k-h