Re: [PATCH] iio: adc: pac1934: validate the ACPI channel configuration

[Andy Shevchenko]

On Tue, Nov 03, 2026 at 07:41:00PM +0800, Kang Chen wrote:
> The four _DSM calls that describe the channel configuration trust the
> returned package.  The first one is walked in pairs and its count is
> used to index the four-element labels[], shunts[] and
> active_channels[] arrays; a longer package writes past them, and an odd
> count reads elements[i + 1] past the end.  Non-string or non-integer
> elements make the driver use union members that hold unrelated data,
> including a firmware-chosen pointer for devm_kmemdup().
> 
> Validate the object type, the package count, and the type of every
> element before using it.  Allocate the labels with devm_kzalloc() and
> reject an impossible allocation length, so the terminating NUL cannot
> be written out of bounds on 32-bit systems.  Reject milliohm values
> that would overflow the u32 micro-ohm fields, and micro-ohm values that
> do not fit in u32.  Also validate the single-element bipolar and
> sample-rate packages before reading them.

There was another patch with better alternative. Check it and test instead of
this one.


-- 
With Best Regards,
Andy Shevchenko