Re: [PATCH v3 1/2] iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm()

[Jonathan Cameron]

On Thu, 29 Oct 2026 11:08:28 +0000
Tristan Madani <tristmd@xxxxxxxxx> wrote:

> From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> 
> cm32181_acpi_get_cpm() accesses cpm->package.count and
> cpm->package.elements without checking that the returned ACPI object
> is of type ACPI_TYPE_PACKAGE.  If firmware returns a different type,
> the package union members alias onto unrelated data.
> 
> Use acpi_evaluate_object_typed() to request an ACPI_TYPE_PACKAGE
> directly, so the ACPI core validates the type before returning.
> Also replace kfree() with ACPI_FREE() for the ACPI-allocated buffer.
> 
> Fixes: d34ca613b939 ("iio: light: cm32181: Add support for parsing CPM0 and CPM1 ACPI tables")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
The threading is broken here.  They are in reply to previous version
which is always a bad idea and not threaded below the cover letter.

Hopefully I picked up the right code.  Applied, but not rushed
so on the testing branch of iio.git.  These are hardening patches
against broken firmware rather than fixes, so I've also dropped
that marking and the +CC stable.

Hardening this stuff is good to have though when it doesn't
add much complexity like this patch.

Thanks,

Jonathan


> ---
>  drivers/iio/light/cm32181.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
> index 9df85b3999fa8..a16fc83bcbb08 100644
> --- a/drivers/iio/light/cm32181.c
> +++ b/drivers/iio/light/cm32181.c
> @@ -115,7 +115,8 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  	if (!handle)
>  		return -ENODEV;
>  
> -	status = acpi_evaluate_object(handle, obj_name, NULL, &buffer);
> +	status = acpi_evaluate_object_typed(handle, obj_name, NULL,
> +					    &buffer, ACPI_TYPE_PACKAGE);
>  	if (ACPI_FAILURE(status)) {
>  		dev_err(dev, "object %s not found\n", obj_name);
>  		return -ENODEV;
> @@ -132,7 +133,7 @@ static int cm32181_acpi_get_cpm(struct device *dev, char *obj_name,
>  		values[i] = elem->integer.value;
>  	}
>  
> -	kfree(buffer.pointer);
> +	ACPI_FREE(buffer.pointer);
>  
>  	return count;
>  }