[PATCH] iio: imu: inv_mpu6050: validate the CNF0 package

[PATCH] iio: imu: inv_mpu6050: validate the CNF0 package

[Kang Chen]

asus_acpi_get_sensor_info() walks the package returned by CNF0 and uses
each element as a package without checking the object type or the
element type.  A top-level string or buffer makes package.count alias
its length and package.elements alias its data pointer.  For a
non-package element, the inner count and elements pointer are taken
from unrelated union members, so the driver can walk a firmware-chosen
pointer and pass it to strscpy().

Require a top-level package and skip elements that are not packages.

Fixes: a35c5d1aa96a ("iio: imu: inv_mpu6050: Create mux clients for ACPI")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index 460792ed27e0..0dc6c042043e 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -57,11 +57,19 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
 		return -ENODEV;
 
 	cpm = buffer.pointer;
+	if (!cpm || cpm->type != ACPI_TYPE_PACKAGE) {
+		kfree(buffer.pointer);
+		return -ENODEV;
+	}
+
 	for (i = 0; i < cpm->package.count; ++i) {
 		union acpi_object *elem;
 		int j;
 
 		elem = &cpm->package.elements[i];
+		if (elem->type != ACPI_TYPE_PACKAGE)
+			continue;
+
 		for (j = 0; j < elem->package.count; ++j) {
 			union acpi_object *sub_elem;
 
-- 
2.34.1

Re: [PATCH] iio: imu: inv_mpu6050: validate the CNF0 package

[Andy Shevchenko]

On Tue, Nov 03, 2026 at 07:41:46PM +0800, Kang Chen wrote:
> asus_acpi_get_sensor_info() walks the package returned by CNF0 and uses
> each element as a package without checking the object type or the
> element type.  A top-level string or buffer makes package.count alias
> its length and package.elements alias its data pointer.  For a
> non-package element, the inner count and elements pointer are taken
> from unrelated union members, so the driver can walk a firmware-chosen
> pointer and pass it to strscpy().
> 
> Require a top-level package and skip elements that are not packages.

acpi_evaluate_object_typed()

-- 
With Best Regards,
Andy Shevchenko