Re: [PATCH] iio: imu: inv_mpu6050: validate the CNF0 package

[Andy Shevchenko]

On Tue, Nov 03, 2026 at 07:41:46PM +0800, Kang Chen wrote:
> asus_acpi_get_sensor_info() walks the package returned by CNF0 and uses
> each element as a package without checking the object type or the
> element type.  A top-level string or buffer makes package.count alias
> its length and package.elements alias its data pointer.  For a
> non-package element, the inner count and elements pointer are taken
> from unrelated union members, so the driver can walk a firmware-chosen
> pointer and pass it to strscpy().
> 
> Require a top-level package and skip elements that are not packages.

acpi_evaluate_object_typed()

-- 
With Best Regards,
Andy Shevchenko