[PATCH] platform/x86: toshiba_acpi: validate ACPI object type in tci_raw()

[PATCH] platform/x86: toshiba_acpi: validate ACPI object type in tci_raw()

[Tristan Madani]

tci_raw() calls acpi_evaluate_object() and uses the returned buffer as
an ACPI_TYPE_PACKAGE without checking its type field. If the ACPI method
returns a different object type, accessing package.count and
package.elements interprets whatever data the union holds as a package
descriptor.

Add a type check before accessing the package fields. Return AE_TYPE
when the result is not a package, when the package has more elements
than TCI_WORDS, or when any element is not an ACPI_TYPE_INTEGER.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/platform/x86/toshiba_acpi.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index a0b8060836d01..4ccc8f51c3a5b 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -342,9 +342,20 @@ static acpi_status tci_raw(struct toshiba_acpi_dev *dev,
 	status = acpi_evaluate_object(dev->acpi_dev->handle,
 				      (char *)dev->method_hci, &params,
 				      &results);
-	if ((status == AE_OK) && (out_objs->package.count <= TCI_WORDS)) {
-		for (i = 0; i < out_objs->package.count; ++i)
-			out[i] = out_objs->package.elements[i].integer.value;
+	if (status == AE_OK) {
+		if (out_objs->type == ACPI_TYPE_PACKAGE &&
+		    out_objs->package.count <= TCI_WORDS) {
+			for (i = 0; i < out_objs->package.count; ++i) {
+				if (out_objs->package.elements[i].type !=
+				    ACPI_TYPE_INTEGER) {
+					status = AE_TYPE;
+					break;
+				}
+				out[i] = out_objs->package.elements[i].integer.value;
+			}
+		} else {
+			status = AE_TYPE;
+		}
 	}
 
 	return status;
-- 
2.47.3

Re: [PATCH] platform/x86: toshiba_acpi: validate ACPI object type in tci_raw()

[Ilpo Järvinen]

On Mon, 2 Nov 2026, Tristan Madani wrote:

> tci_raw() calls acpi_evaluate_object() and uses the returned buffer as
> an ACPI_TYPE_PACKAGE without checking its type field. If the ACPI method
> returns a different object type, accessing package.count and
> package.elements interprets whatever data the union holds as a package
> descriptor.
> 
> Add a type check before accessing the package fields. Return AE_TYPE
> when the result is not a package, when the package has more elements
> than TCI_WORDS, or when any element is not an ACPI_TYPE_INTEGER.

Your ACPI validation patches seem to lack information whether these 
actually have been observed to occur on some device.

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/platform/x86/toshiba_acpi.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
> index a0b8060836d01..4ccc8f51c3a5b 100644
> --- a/drivers/platform/x86/toshiba_acpi.c
> +++ b/drivers/platform/x86/toshiba_acpi.c
> @@ -342,9 +342,20 @@ static acpi_status tci_raw(struct toshiba_acpi_dev *dev,
>  	status = acpi_evaluate_object(dev->acpi_dev->handle,
>  				      (char *)dev->method_hci, &params,
>  				      &results);
> -	if ((status == AE_OK) && (out_objs->package.count <= TCI_WORDS)) {
> -		for (i = 0; i < out_objs->package.count; ++i)
> -			out[i] = out_objs->package.elements[i].integer.value;
> +	if (status == AE_OK) {
> +		if (out_objs->type == ACPI_TYPE_PACKAGE &&
> +		    out_objs->package.count <= TCI_WORDS) {
> +			for (i = 0; i < out_objs->package.count; ++i) {
> +				if (out_objs->package.elements[i].type !=
> +				    ACPI_TYPE_INTEGER) {
> +					status = AE_TYPE;
> +					break;
> +				}
> +				out[i] = out_objs->package.elements[i].integer.value;
> +			}
> +		} else {
> +			status = AE_TYPE;
> +		}
>  	}
>  
>  	return status;
> 

-- 
 i.