[PATCH] platform/x86: system76: fix off-by-one in system76_name()

[Kang Chen]

system76_name() accepts index == obj->package.count and reads
elements[index], one element past the end of the package.  If the
adjacent memory happens to look like an ACPI string object, the driver
returns a wild pointer that is printed with %s through the hwmon
interface; otherwise it reads out of bounds.

Use a strict upper bound and reject negative indexes as well.

Fixes: 95563d45b5da ("platform/x86: system76_acpi: Report temperature and fan speed")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/platform/x86/system76_acpi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/system76_acpi.c b/drivers/platform/x86/system76_acpi.c
index dd7b1b07c316..4cd6a7f45a8c 100644
--- a/drivers/platform/x86/system76_acpi.c
+++ b/drivers/platform/x86/system76_acpi.c
@@ -128,7 +128,8 @@ static int system76_get_object(struct system76_data *data, char *method, union a
 // Get a name from a System76 ACPI device object
 static char *system76_name(union acpi_object *obj, int index)
 {
-	if (obj && obj->type == ACPI_TYPE_PACKAGE && index <= obj->package.count) {
+	if (obj && obj->type == ACPI_TYPE_PACKAGE &&
+	    index >= 0 && index < obj->package.count) {
 		if (obj->package.elements[index].type == ACPI_TYPE_STRING)
 			return obj->package.elements[index].string.pointer;
 	}
-- 
2.34.1