Re: [PATCH v5] iio: adc: pac1934: validate ACPI _DSM return type and bounds

[Marius.Cristea]

On Fri, 2026-10-30 at 12:35 +0000, Tristan Madani wrote:
> EXTERNAL EMAIL: Do not click links or open attachments unless you
> know the content is safe
> 
> From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> 
> pac1934_acpi_parse_channel_config() calls acpi_evaluate_dsm() four
> times to read channel configuration but does not validate the
> returned
> object type or array bounds:
> 
>   1. No check that the returned object is ACPI_TYPE_PACKAGE.  If
>      firmware returns a different type, accessing rez->package.count
>      and rez->package.elements on a non-package object produces
>      unpredictable values.
> 
>   2. The loop bounds use rez->package.count directly without capping
>      to PAC1934_MAX_NUM_CHANNELS (4).  A package with more elements
>      than expected causes writes past the fixed-size labels[],
>      shunts[], and active_channels[] arrays.
> 
>   3. The bipolar and sample rate DSM calls access elements[0] without
>      verifying package.count >= 1.
> 
> Use acpi_evaluate_dsm_typed() with ACPI_TYPE_PACKAGE to validate the
> return type at evaluation time.  Cap loop iterations to
> PAC1934_MAX_NUM_CHANNELS, and verify package count >= 1 before
> accessing elements[0].
> 
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
> Changes in v5:
> - Keep existing declaration order, only add new 'count' variable, per
>   Andy Shevchenko
> - Replace (count & ~1u) with min_t() cap and i + 1 < count loop bound
>   to avoid unsigned literal question, per Andy Shevchenko
> 
> Changes in v4:
> - Reorder variable declarations to reverse xmas tree, per Andy
> Shevchenko
> - Drop casts from min() parameters, per Andy Shevchenko
> 
> Changes in v3:
> - Use acpi_evaluate_dsm_typed() instead of manual type checks, per
>   Andy Shevchenko
> - Use (count & ~1u) for the name+mohm loop bound to ensure pairs
>   are complete, per Andy Shevchenko
> - Drop Fixes: and Cc: stable tags since this is hardening rather
>   than a fix for a specific regression, per Jonathan Cameron
>  drivers/iio/adc/pac1934.c | 33 +++++++++++++++++++++++++++------
>  1 file changed, 27 insertions(+), 6 deletions(-)
> 


Reviewed-by: Marius Cristea <marius.cristea@xxxxxxxxxxxxx>