[PATCH] iio: adc: pac1921: validate the ACPI description

[PATCH] iio: adc: pac1921: validate the ACPI description

[Kang Chen]

pac1921_match_acpi_device() reads elements[0] of both _DSM replies
without checking the top-level object type, the package count, or the
element type.  An empty package makes elements[0] an out-of-bounds
read.  A string reply to the shunt query, or an integer reply to the
label query, makes the driver interpret unrelated union members; for
the label query this can pass a firmware-chosen pointer to
devm_kstrdup().

Require a package with at least one element of the expected type before
reading it.  Also reject a shunt value that does not fit in the int
range checked by the driver before it is truncated to u32.

Fixes: 9fdf1d033316 ("iio: adc: pac1921: Add ACPI support to Microchip pac1921")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/iio/adc/pac1921.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/iio/adc/pac1921.c b/drivers/iio/adc/pac1921.c
index f0bab94462f4..3242928d80e4 100644
--- a/drivers/iio/adc/pac1921.c
+++ b/drivers/iio/adc/pac1921.c
@@ -1189,6 +1189,19 @@ static int pac1921_match_acpi_device(struct iio_dev *indio_dev)
 		return dev_err_probe(dev, -EINVAL,
 				     "Could not read shunt from ACPI table\n");
 
+	if (status->type != ACPI_TYPE_PACKAGE || status->package.count < 1 ||
+	    status->package.elements[0].type != ACPI_TYPE_INTEGER) {
+		ACPI_FREE(status);
+		return dev_err_probe(dev, -EINVAL,
+				     "Invalid shunt value from ACPI table\n");
+	}
+
+	if (status->package.elements[0].integer.value > INT_MAX) {
+		ACPI_FREE(status);
+		return dev_err_probe(dev, -EINVAL,
+				     "Shunt value out of range from ACPI table\n");
+	}
+
 	priv->rshunt_uohm = status->package.elements[0].integer.value;
 	ACPI_FREE(status);
 
@@ -1198,6 +1211,13 @@ static int pac1921_match_acpi_device(struct iio_dev *indio_dev)
 		return dev_err_probe(dev, -EINVAL,
 				     "Could not read label from ACPI table\n");
 
+	if (status->type != ACPI_TYPE_PACKAGE || status->package.count < 1 ||
+	    status->package.elements[0].type != ACPI_TYPE_STRING) {
+		ACPI_FREE(status);
+		return dev_err_probe(dev, -EINVAL,
+				     "Invalid label from ACPI table\n");
+	}
+
 	label = devm_kstrdup(dev, status->package.elements[0].string.pointer,
 			     GFP_KERNEL);
 	ACPI_FREE(status);
-- 
2.34.1

Re: [PATCH] iio: adc: pac1921: validate the ACPI description

[Andy Shevchenko]

On Tue, Nov 03, 2026 at 07:41:15PM +0800, Kang Chen wrote:
> pac1921_match_acpi_device() reads elements[0] of both _DSM replies
> without checking the top-level object type, the package count, or the
> element type.  An empty package makes elements[0] an out-of-bounds
> read.  A string reply to the shunt query, or an integer reply to the
> label query, makes the driver interpret unrelated union members; for
> the label query this can pass a firmware-chosen pointer to
> devm_kstrdup().
> 
> Require a package with at least one element of the expected type before
> reading it.  Also reject a shunt value that does not fit in the int
> range checked by the driver before it is truncated to u32.

Check mailing list for potential prior work.

...

> +	if (status->type != ACPI_TYPE_PACKAGE || status->package.count < 1 ||

What's wrong with _typed() variant of acpi_evaluate_dsm()?

> +	    status->package.elements[0].type != ACPI_TYPE_INTEGER) {
> +		ACPI_FREE(status);
> +		return dev_err_probe(dev, -EINVAL,
> +				     "Invalid shunt value from ACPI table\n");
> +	}

-- 
With Best Regards,
Andy Shevchenko