summaryrefslogtreecommitdiff
path: root/scripts/sbom/git@git.tavy.me:linux-stable.git
diff options
context:
space:
mode:
authorHyeongJun An <sammiee5311@gmail.com>2026-06-19 21:27:46 +0900
committerGuenter Roeck <linux@roeck-us.net>2026-06-29 08:51:59 -0700
commite2735b39f044bad7bf2017aef248935525bc0b97 (patch)
tree08cc457c295b74f4bd2ac7d61f69b097ae9b2add /scripts/sbom/git@git.tavy.me:linux-stable.git
parent40ac87fedb4ceaae0aa3a427c371d4a0a1fae335 (diff)
hwmon: (asus_atk0110) Check package count before accessing element
atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj->package.elements[0]; if (id->type != ACPI_TYPE_INTEGER) without checking that the sub-package is non-empty. ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation. The sibling function atk_debugfs_ggrp_open() performs the same access but skips empty packages with a package.count check first. Add the same check to atk_ec_present() so a malformed firmware package cannot trigger an out-of-bounds read. Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'scripts/sbom/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions