Re: [PATCH] ACPI: property: verify nested _DSD packages

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 12:42 PM Kang Chen <k.chen@xxxxxxxxxxxxxxxx> wrote:
>
> acpi_properties_format_valid() and acpi_add_nondev_subnodes() inspect
> the package.count of nested elements before checking that those
> elements actually are packages.  In union acpi_object, count aliases
> the length of a string or buffer, so a Buffer(2) or String(2) element
> passes the two-element test and the following elements[0]/elements[1]
> accesses read past the small allocation.  In the non-device subnode
> path, the resulting string pointer can reach acpi_get_handle().
>
> Test for ACPI_TYPE_PACKAGE before using package.count in both
> functions.  Also require an even number of entries in the _DSD package
> before reading paired GUID/link elements.
>
> Fixes: ffdcd955c307 ("ACPI: Add support for device specific properties")
> Fixes: 99db5ff7fe0b ("ACPI / property: Hierarchical properties support update")
> Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>

Applied as 7.5 material, thanks!

> ---
>  drivers/acpi/property.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
> index 8ee5a1f0eb48..f5e0dc87edde 100644
> --- a/drivers/acpi/property.c
> +++ b/drivers/acpi/property.c
> @@ -194,7 +194,8 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope,
>
>                 link = &links->package.elements[i];
>                 /* Only two elements allowed. */
> -               if (link->package.count != 2)
> +               if (link->type != ACPI_TYPE_PACKAGE ||
> +                   link->package.count != 2)
>                         continue;
>
>                 /* The first one (the key) must be a string. */
> @@ -262,6 +263,9 @@ static bool acpi_enumerate_nondev_subnodes(acpi_handle scope,
>         int i;
>
>         /* Look for the ACPI data subnodes GUID. */
> +       if (desc->package.count % 2)
> +               return false;
> +
>         for (i = 0; i < desc->package.count; i += 2) {
>                 const union acpi_object *guid;
>                 union acpi_object *links;
> @@ -331,9 +335,10 @@ static bool acpi_properties_format_valid(const union acpi_object *properties)
>                  * Only two elements allowed, the first one must be a string and
>                  * the second one has to satisfy certain conditions.
>                  */
> -               if (property->package.count != 2
> -                   || property->package.elements[0].type != ACPI_TYPE_STRING
> -                   || !acpi_property_value_ok(&property->package.elements[1]))
> +               if (property->type != ACPI_TYPE_PACKAGE ||
> +                   property->package.count != 2 ||
> +                   property->package.elements[0].type != ACPI_TYPE_STRING ||
> +                   !acpi_property_value_ok(&property->package.elements[1]))
>                         return false;
>         }
>         return true;
> --
> 2.34.1
>