Re: [PATCH 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron]

On Sun, 25 Oct 2026 18:03:22 +0000
Tristan Madani <tristmd@xxxxxxxxx> wrote:

> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Add the missing type check after the ACPI evaluation and before
> accessing the package contents.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>

Can we use acpi_evaluate_object_typed() so that we failure the
earlier call?

Whilst we are here can we also swap the kfree() for ACPI_FREE().

Jonathan


> ---
>  drivers/iio/light/cm32181.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index b32a94028f091..1528465be6adb 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -121,6 +121,11 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	}
>  
>  	cpm = buffer.pointer;
> +	if (cpm->type != ACPI_TYPE_PACKAGE) {
> +		dev_err(dev, "object %s is not a package\n", obj_name);
> +		kfree(buffer.pointer);
> +		return -EINVAL;
> +	}
>  	if (cpm->package.count > count)
>  		dev_warn(dev, "%s table contains %u values, only using first %d values\n",
>  			 obj_name, cpm->package.count, count);