Re: [PATCH v7] iio: adc: pac1934: validate ACPI _DSM return type and bounds

[Jonathan Cameron]

On Tue, 3 Nov 2026 23:02:41 +0200
Andy Shevchenko <andriy.shevchenko@xxxxxxxxx> wrote:

> On Tue, Nov 03, 2026 at 06:50:26PM +0000, Tristan Madani wrote:
> > 
> > pac1934_acpi_parse_channel_config() calls acpi_evaluate_dsm() four
> > times to read channel configuration but does not validate the returned
> > object type or array bounds:
> > 
> >   1. No check that the returned object is ACPI_TYPE_PACKAGE.  If
> >      firmware returns a different type, accessing rez->package.count
> >      and rez->package.elements on a non-package object produces
> >      unpredictable values.
> > 
> >   2. The loop bounds use rez->package.count directly without capping
> >      to PAC1934_MAX_NUM_CHANNELS (4).  A package with more elements
> >      than expected causes writes past the fixed-size labels[],
> >      shunts[], and active_channels[] arrays.
> > 
> >   3. The bipolar and sample rate DSM calls access elements[0] without
> >      verifying package.count >= 1.
> > 
> > Use acpi_evaluate_dsm_typed() with ACPI_TYPE_PACKAGE to validate the
> > return type at evaluation time.  Cap loop iterations to
> > PAC1934_MAX_NUM_CHANNELS, and verify package count >= 1 before
> > accessing elements[0].  
> 
> LGTM now,
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxx>
> 

Applied to the testing branch of iio.git.

Thanks,

Jonathan