From 5c382ef425c875bf854d411fb0a45909878a233a Mon Sep 17 00:00:00 2001 From: Wei Huang Date: Thu, 24 Sep 2026 14:05:43 -0500 Subject: [PATCH] PCI/TPH: Validate the firmware Steering Tag response TPH _DSM returns an eight-byte Steering Tag information buffer. Checking only the ACPI object type allows a short firmware response to be read beyond the end of its buffer. For safety, require a non-NULL buffer containing the complete value before copying it. Use memcpy() so that reading the response does not depend on the alignment of the firmware buffer. Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support") Signed-off-by: Wei Huang Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260924190543.3424792-1-wei.huang2@amd.com --- drivers/pci/tph.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c index 655ffd60e62f..4d064b86befc 100644 --- a/drivers/pci/tph.c +++ b/drivers/pci/tph.c @@ -119,12 +119,14 @@ static acpi_status tph_invoke_dsm(acpi_handle handle, u32 cpu_uid, if (!out_obj) return AE_ERROR; - if (out_obj->type != ACPI_TYPE_BUFFER) { + if (out_obj->type != ACPI_TYPE_BUFFER || + out_obj->buffer.length < sizeof(st_out->value) || + !out_obj->buffer.pointer) { ACPI_FREE(out_obj); return AE_ERROR; } - st_out->value = *((u64 *)(out_obj->buffer.pointer)); + memcpy(&st_out->value, out_obj->buffer.pointer, sizeof(st_out->value)); ACPI_FREE(out_obj);