Re: [PATCH 1/1] PCI/TPH: Validate the firmware Steering Tag response

[Bjorn Helgaas]

On Thu, Sep 24, 2026 at 02:05:43PM -0500, Wei Huang wrote:
> TPH _DSM returns an eight-byte Steering Tag information buffer.
> Checking only the ACPI object type allows a short firmware response
> to be read beyond the end of its buffer.
> 
> For safety, require a non-NULL buffer containing the complete value
> before copying it. Use memcpy() so that reading the response does not
> depend on the alignment of the firmware buffer.
> 
> Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support")
> Signed-off-by: Wei Huang <wei.huang2@xxxxxxx>

Applied to pci/tph for v7.4, thanks!

> ---
>  drivers/pci/tph.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
> index 655ffd60e62f..4d064b86befc 100644
> --- a/drivers/pci/tph.c
> +++ b/drivers/pci/tph.c
> @@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid,
>  	if (!out_obj)
>  		return AE_ERROR;
>  
> -	if (out_obj->type != ACPI_TYPE_BUFFER) {
> +	if (out_obj->type != ACPI_TYPE_BUFFER ||
> +	    out_obj->buffer.length < sizeof(st_out->value) ||
> +	    !out_obj->buffer.pointer) {
>  		ACPI_FREE(out_obj);
>  		return AE_ERROR;
>  	}
>  
> -	st_out->value = *((u64 *)(out_obj->buffer.pointer));
> +	memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value));
>  
>  	ACPI_FREE(out_obj);
>  
> -- 
> 2.55.0
>