Re: [PATCH] platform/x86: toshiba_acpi: validate ACPI object type in tci_raw()

[Ilpo Järvinen]

On Mon, 2 Nov 2026, Tristan Madani wrote:

> tci_raw() calls acpi_evaluate_object() and uses the returned buffer as
> an ACPI_TYPE_PACKAGE without checking its type field. If the ACPI method
> returns a different object type, accessing package.count and
> package.elements interprets whatever data the union holds as a package
> descriptor.
> 
> Add a type check before accessing the package fields. Return AE_TYPE
> when the result is not a package, when the package has more elements
> than TCI_WORDS, or when any element is not an ACPI_TYPE_INTEGER.

Your ACPI validation patches seem to lack information whether these 
actually have been observed to occur on some device.

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/platform/x86/toshiba_acpi.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
> index a0b8060836d01..4ccc8f51c3a5b 100644
> --- a/drivers/platform/x86/toshiba_acpi.c
> +++ b/drivers/platform/x86/toshiba_acpi.c
> @@ -342,9 +342,20 @@ static acpi_status tci_raw(struct toshiba_acpi_dev *dev,
>  	status = acpi_evaluate_object(dev->acpi_dev->handle,
>  				      (char *)dev->method_hci, &params,
>  				      &results);
> -	if ((status == AE_OK) && (out_objs->package.count <= TCI_WORDS)) {
> -		for (i = 0; i < out_objs->package.count; ++i)
> -			out[i] = out_objs->package.elements[i].integer.value;
> +	if (status == AE_OK) {
> +		if (out_objs->type == ACPI_TYPE_PACKAGE &&
> +		    out_objs->package.count <= TCI_WORDS) {
> +			for (i = 0; i < out_objs->package.count; ++i) {
> +				if (out_objs->package.elements[i].type !=
> +				    ACPI_TYPE_INTEGER) {
> +					status = AE_TYPE;
> +					break;
> +				}
> +				out[i] = out_objs->package.elements[i].integer.value;
> +			}
> +		} else {
> +			status = AE_TYPE;
> +		}
>  	}
>  
>  	return status;
> 

-- 
 i.