diff options
| author | HyeongJun An <sammiee5311@gmail.com> | 2026-06-19 21:27:46 +0900 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-06-29 08:51:59 -0700 |
| commit | e2735b39f044bad7bf2017aef248935525bc0b97 (patch) | |
| tree | 08cc457c295b74f4bd2ac7d61f69b097ae9b2add /scripts | |
| parent | 40ac87fedb4ceaae0aa3a427c371d4a0a1fae335 (diff) | |
hwmon: (asus_atk0110) Check package count before accessing element
atk_ec_present() walks the management group package returned by the GGRP
ACPI method and, for each sub-package, reads its first element:
id = &obj->package.elements[0];
if (id->type != ACPI_TYPE_INTEGER)
without checking that the sub-package is non-empty. ACPICA allocates the
element array with exactly package.count entries, so for a sub-package
with a zero count this reads past the allocation.
The sibling function atk_debugfs_ggrp_open() performs the same access but
skips empty packages with a package.count check first. Add the same
check to atk_ec_present() so a malformed firmware package cannot trigger
an out-of-bounds read.
Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions
