Re: [PATCH] ACPI: processor: check the _CST register buffer length

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 12:41 PM Kang Chen <k.chen@xxxxxxxxxxxxxxxx> wrote:
>
> acpi_processor_evaluate_cst() casts the first buffer of each _CST
> C-state package to struct acpi_power_register without checking
> buffer.length.  A short buffer makes the driver read past the ACPI
> allocation and use the resulting address and space_id, which can reach
> acpi_processor_ffh_cstate_probe() and rdmsr().  The _LPI path already
> performs this check.
>
> Skip C-states whose register buffer is smaller than
> struct acpi_power_register.
>
> The check has been missing since before the current git history; the
> initial git import is the earliest tree containing the code.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>

Changes starting to reject firmware-supplied data that have been
accepted all the time so far are generally risky, but this particular
one should not appear to be problematic AFAICS.

So (tentatively) applied as 7.5 material, thanks!

> ---
>  drivers/acpi/acpi_processor.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> index 5fbab54171b7..d77c90a243cf 100644
> --- a/drivers/acpi/acpi_processor.c
> +++ b/drivers/acpi/acpi_processor.c
> @@ -903,6 +903,12 @@ int acpi_processor_evaluate_cst(acpi_handle handle, u32 cpu,
>                         continue;
>                 }
>
> +               if (obj->buffer.length < sizeof(*reg)) {
> +                       acpi_handle_info(handle, "_CST C%d package element[0] buffer too small, skip...\n",
> +                                        i);
> +                       continue;
> +               }
> +
>                 reg = (struct acpi_power_register *)obj->buffer.pointer;
>
>                 obj = &element->package.elements[1];
> --
> 2.34.1
>