[PATCH] ata: libata-acpi: check the _GTM return object before using it

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

ata_acpi_gtm() evaluates _GTM with acpi_evaluate_object() and, after
checking the status, dereferences output.pointer without checking it.

acpi_evaluate_object() can return AE_OK with a zero-length result and a
NULL output.pointer.  A _GTM method returning a reference to a method
local does exactly that: ACPICA clears the reference when the method
terminates, so the caller ends up with no object.  ata_acpi_gtm() then
dereferences the NULL pointer while probing the ATA port.

ata_dev_get_GTF(), the sibling function in this file, already checks both
output.length and output.pointer before using the result.  Add the same
check to ata_acpi_gtm().

Fixes: 64578a3de723 ("libata-acpi: implement _GTM/_STM support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
Tested on 7.3.0-next-20261030 (QEMU/TCG guest) with a PIIX3 IDE
controller.  A TEST-ONLY SSDT, loaded with -acpitable on both kernels,
adds a _GTM method that returns a reference to a method local.  ACPICA
clears that reference when the method terminates, so
acpi_evaluate_object() returns AE_OK with a NULL object.

  unpatched                            patched
  BUG: kernel NULL pointer             no panic; ata1/ata2 probe
  dereference in ata_acpi_gtm          /dev/sda probes
  Kernel panic - not syncing

The diagnostic is emitted with ata_port_dbg(): a _GTM method that keeps
returning no object is a permanent firmware deviation and the check runs
on every reset, so a KERN_ERR would spam the log indefinitely.
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 4433f626246b..a0b85f74eabb 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -376,6 +376,11 @@ int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
 	}
 
 	out_obj = output.pointer;
+	if (!out_obj || !output.length) {
+		ata_port_dbg(ap, "_GTM returned no object\n");
+		goto out_free;
+	}
+
 	if (out_obj->type != ACPI_TYPE_BUFFER) {
 		ata_port_warn(ap, "_GTM returned unexpected object type 0x%x\n",
 			      out_obj->type);