Re: [PATCH] iio: adc: pac1921: validate the ACPI description

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Tue, Nov 03, 2026 at 07:41:15PM +0800, Kang Chen wrote:
> pac1921_match_acpi_device() reads elements[0] of both _DSM replies
> without checking the top-level object type, the package count, or the
> element type.  An empty package makes elements[0] an out-of-bounds
> read.  A string reply to the shunt query, or an integer reply to the
> label query, makes the driver interpret unrelated union members; for
> the label query this can pass a firmware-chosen pointer to
> devm_kstrdup().
> 
> Require a package with at least one element of the expected type before
> reading it.  Also reject a shunt value that does not fit in the int
> range checked by the driver before it is truncated to u32.

Check mailing list for potential prior work.

...

> +	if (status->type != ACPI_TYPE_PACKAGE || status->package.count < 1 ||

What's wrong with _typed() variant of acpi_evaluate_dsm()?

> +	    status->package.elements[0].type != ACPI_TYPE_INTEGER) {
> +		ACPI_FREE(status);
> +		return dev_err_probe(dev, -EINVAL,
> +				     "Invalid shunt value from ACPI table\n");
> +	}

-- 
With Best Regards,
Andy Shevchenko