github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

PCI/TPH: Validate the firmware Steering Tag response

Browse Source 
TPH _DSM returns an eight-byte Steering Tag information buffer.  Checking
only the ACPI object type allows a short firmware response to be read
beyond the end of its buffer.

For safety, require a non-NULL buffer containing the complete value before
copying it. Use memcpy() so that reading the response does not depend on
the alignment of the firmware buffer.

Fixes: d2e8a34876 ("PCI/TPH: Add Steering Tag support")
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260924190543.3424792-1-wei.huang2@amd.com
This commit is contained in:
Wei Huang 2026-09-24 14:05:43 -05:00 committed by Bjorn Helgaas
parent cee9395acd
commit 5c382ef425
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/pci/tph.c
View File

@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid,
if (!out_obj)
return AE_ERROR;
if (out_obj->type != ACPI_TYPE_BUFFER) {
if (out_obj->type != ACPI_TYPE_BUFFER ||
out_obj->buffer.length < sizeof(st_out->value) ||
!out_obj->buffer.pointer) {
ACPI_FREE(out_obj);
return AE_ERROR;
}
st_out->value = *((u64 *)(out_obj->buffer.pointer));
memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value));
ACPI_FREE(out_obj);