[PATCH] ACPI: video: reject out-of-range _BQC indexes

[PATCH] ACPI: video: reject out-of-range _BQC indexes

[Kang Chen]

acpi_video_bqc_value_to_level() indexes brightness->levels[] with the
value returned by _BQC once the index quirk has been armed, but does
not verify that the value is inside the array.  A firmware that behaves
consistently during the quirk detection and then returns a large value
can make the driver read out of bounds; the reversed branch also
underflows before indexing.

Return an invalid level when the index is out of range, so that the
existing callers disable _BQC.  Also guard against a brightness table
with no usable levels, and tighten the range check in the quirk
detection before its reversed subtraction.

Fixes: 994fa63c5b12 ("ACPI / video: Fix applying indexed initial brightness value.")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/acpi/acpi_video.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2a2822516665..44af7ffb9a81 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -533,6 +533,13 @@ acpi_video_bqc_value_to_level(struct acpi_video_device *device,
 		 * items with special meaning (see enum acpi_video_level_idx),
 		 * so we need to compensate for that by offsetting ourselves
 		 */
+		if (device->brightness->count <= ACPI_VIDEO_FIRST_LEVEL)
+			return U64_MAX;
+
+		if (bqc_value >= device->brightness->count -
+				 ACPI_VIDEO_FIRST_LEVEL)
+			return U64_MAX;
+
 		if (device->brightness->flags._BCL_reversed)
 			bqc_value = device->brightness->count -
 				ACPI_VIDEO_FIRST_LEVEL - 1 - bqc_value;
@@ -781,7 +788,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
 
 	if (level != test_level) {
 		/* buggy _BQC found, need to find out if it uses index */
-		if (level < br->count) {
+		if (level < br->count - ACPI_VIDEO_FIRST_LEVEL) {
 			if (br->flags._BCL_reversed)
 				level = br->count - ACPI_VIDEO_FIRST_LEVEL - 1 - level;
 			if (br->levels[level + ACPI_VIDEO_FIRST_LEVEL] == test_level)
-- 
2.34.1

Re: [PATCH] ACPI: video: reject out-of-range _BQC indexes

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 12:41 PM Kang Chen <k.chen@smail.nju.edu.cn> wrote:
>
> acpi_video_bqc_value_to_level() indexes brightness->levels[] with the
> value returned by _BQC once the index quirk has been armed, but does
> not verify that the value is inside the array.  A firmware that behaves
> consistently during the quirk detection and then returns a large value
> can make the driver read out of bounds; the reversed branch also
> underflows before indexing.
>
> Return an invalid level when the index is out of range, so that the
> existing callers disable _BQC.  Also guard against a brightness table
> with no usable levels, and tighten the range check in the quirk
> detection before its reversed subtraction.
>
> Fixes: 994fa63c5b12 ("ACPI / video: Fix applying indexed initial brightness value.")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
> ---
>  drivers/acpi/acpi_video.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
> index 2a2822516665..44af7ffb9a81 100644
> --- a/drivers/acpi/acpi_video.c
> +++ b/drivers/acpi/acpi_video.c
> @@ -533,6 +533,13 @@ acpi_video_bqc_value_to_level(struct acpi_video_device *device,
>                  * items with special meaning (see enum acpi_video_level_idx),
>                  * so we need to compensate for that by offsetting ourselves
>                  */
> +               if (device->brightness->count <= ACPI_VIDEO_FIRST_LEVEL)
> +                       return U64_MAX;
> +
> +               if (bqc_value >= device->brightness->count -
> +                                ACPI_VIDEO_FIRST_LEVEL)
> +                       return U64_MAX;
> +
>                 if (device->brightness->flags._BCL_reversed)
>                         bqc_value = device->brightness->count -
>                                 ACPI_VIDEO_FIRST_LEVEL - 1 - bqc_value;
> @@ -781,7 +788,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
>
>         if (level != test_level) {
>                 /* buggy _BQC found, need to find out if it uses index */
> -               if (level < br->count) {
> +               if (level < br->count - ACPI_VIDEO_FIRST_LEVEL) {
>                         if (br->flags._BCL_reversed)
>                                 level = br->count - ACPI_VIDEO_FIRST_LEVEL - 1 - level;
>                         if (br->levels[level + ACPI_VIDEO_FIRST_LEVEL] == test_level)
> --

Applied as 7.5 material, thanks!