[PATCH 1/1] PCI/TPH: Validate the firmware Steering Tag response

[Wei Huang]

TPH _DSM returns an eight-byte Steering Tag information buffer.
Checking only the ACPI object type allows a short firmware response
to be read beyond the end of its buffer.

For safety, require a non-NULL buffer containing the complete value
before copying it. Use memcpy() so that reading the response does not
depend on the alignment of the firmware buffer.

Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support")
Signed-off-by: Wei Huang <wei.huang2@xxxxxxx>
---
 drivers/pci/tph.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
index 655ffd60e62f..4d064b86befc 100644
--- a/drivers/pci/tph.c
+++ b/drivers/pci/tph.c
@@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid,
 	if (!out_obj)
 		return AE_ERROR;
 
-	if (out_obj->type != ACPI_TYPE_BUFFER) {
+	if (out_obj->type != ACPI_TYPE_BUFFER ||
+	    out_obj->buffer.length < sizeof(st_out->value) ||
+	    !out_obj->buffer.pointer) {
 		ACPI_FREE(out_obj);
 		return AE_ERROR;
 	}
 
-	st_out->value = *((u64 *)(out_obj->buffer.pointer));
+	memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value));
 
 	ACPI_FREE(out_obj);
 
-- 
2.55.0