Re: [PATCH] ACPI: video: reject out-of-range _BQC indexes

["Rafael J. Wysocki (Intel)" <rafael@kernel.org>]

On Tue, Nov 3, 2026 at 12:41 PM Kang Chen <k.chen@smail.nju.edu.cn> wrote:
>
> acpi_video_bqc_value_to_level() indexes brightness->levels[] with the
> value returned by _BQC once the index quirk has been armed, but does
> not verify that the value is inside the array.  A firmware that behaves
> consistently during the quirk detection and then returns a large value
> can make the driver read out of bounds; the reversed branch also
> underflows before indexing.
>
> Return an invalid level when the index is out of range, so that the
> existing callers disable _BQC.  Also guard against a brightness table
> with no usable levels, and tighten the range check in the quirk
> detection before its reversed subtraction.
>
> Fixes: 994fa63c5b12 ("ACPI / video: Fix applying indexed initial brightness value.")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
> ---
>  drivers/acpi/acpi_video.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
> index 2a2822516665..44af7ffb9a81 100644
> --- a/drivers/acpi/acpi_video.c
> +++ b/drivers/acpi/acpi_video.c
> @@ -533,6 +533,13 @@ acpi_video_bqc_value_to_level(struct acpi_video_device *device,
>                  * items with special meaning (see enum acpi_video_level_idx),
>                  * so we need to compensate for that by offsetting ourselves
>                  */
> +               if (device->brightness->count <= ACPI_VIDEO_FIRST_LEVEL)
> +                       return U64_MAX;
> +
> +               if (bqc_value >= device->brightness->count -
> +                                ACPI_VIDEO_FIRST_LEVEL)
> +                       return U64_MAX;
> +
>                 if (device->brightness->flags._BCL_reversed)
>                         bqc_value = device->brightness->count -
>                                 ACPI_VIDEO_FIRST_LEVEL - 1 - bqc_value;
> @@ -781,7 +788,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
>
>         if (level != test_level) {
>                 /* buggy _BQC found, need to find out if it uses index */
> -               if (level < br->count) {
> +               if (level < br->count - ACPI_VIDEO_FIRST_LEVEL) {
>                         if (br->flags._BCL_reversed)
>                                 level = br->count - ACPI_VIDEO_FIRST_LEVEL - 1 - level;
>                         if (br->levels[level + ACPI_VIDEO_FIRST_LEVEL] == test_level)
> --

Applied as 7.5 material, thanks!