drivers/acpi/pfr_update.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:
memcpy(&cap_hdr->code_type,
elements[CAP_CODE_TYPE_IDX].buffer.pointer,
elements[CAP_CODE_TYPE_IDX].buffer.length);
The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.
struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.
Fix by clamping each memcpy length to the size of its destination
field with min_t(u32, buffer.length, sizeof(cap_hdr->field)).
Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
---
drivers/acpi/pfr_update.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 6283105bb0e8..0219347cd78f 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -161,24 +161,28 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
memcpy(&cap_hdr->code_type,
out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
- out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length);
+ min_t(u32, out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length,
+ sizeof(cap_hdr->code_type)));
cap_hdr->fw_version =
out_obj->package.elements[CAP_FW_VER_IDX].integer.value;
cap_hdr->code_rt_version =
out_obj->package.elements[CAP_CODE_RT_VER_IDX].integer.value;
memcpy(&cap_hdr->drv_type,
out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.pointer,
- out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length);
+ min_t(u32, out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length,
+ sizeof(cap_hdr->drv_type)));
cap_hdr->drv_rt_version =
out_obj->package.elements[CAP_DRV_RT_VER_IDX].integer.value;
cap_hdr->drv_svn =
out_obj->package.elements[CAP_DRV_SVN_IDX].integer.value;
memcpy(&cap_hdr->platform_id,
out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.pointer,
- out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length);
+ min_t(u32, out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length,
+ sizeof(cap_hdr->platform_id)));
memcpy(&cap_hdr->oem_id,
out_obj->package.elements[CAP_OEM_ID_IDX].buffer.pointer,
- out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length);
+ min_t(u32, out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length,
+ sizeof(cap_hdr->oem_id)));
cap_hdr->oem_info_len =
out_obj->package.elements[CAP_OEM_INFO_IDX].buffer.length;
--
2.55.0> If the firmware wants the kernel to copy more data than the latter has
> room for, the operation should fail instead of pretending to succeed.
Agreed. v2 validates all four buffer lengths upfront and returns
-EINVAL if any exceeds its destination field size.
---
query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:
memcpy(&cap_hdr->code_type,
elements[CAP_CODE_TYPE_IDX].buffer.pointer,
elements[CAP_CODE_TYPE_IDX].buffer.length);
The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.
struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.
Fix by validating each buffer length against its destination field
size before copying, and returning -EINVAL if the firmware supplies
an oversized buffer.
Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
---
drivers/acpi/pfr_update.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 6283105bb0e8..e14e053cea44 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -158,6 +158,14 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
goto free_acpi_buffer;
}
+ if (out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length > sizeof(cap_hdr->code_type) ||
+ out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length > sizeof(cap_hdr->drv_type) ||
+ out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length > sizeof(cap_hdr->platform_id) ||
+ out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length > sizeof(cap_hdr->oem_id)) {
+ ret = -EINVAL;
+ goto free_acpi_buffer;
+ }
+
cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
memcpy(&cap_hdr->code_type,
out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
--
2.55.0
From: Anirudh Prasad <icarus@a0rg.com>
To: "linux-acpi"<linux-acpi@vger.kernel.org>
Cc: "rafaeljwysocki"<rafael.j.wysocki@intel.com>, "linux-kernel"<linux-kernel@vger.kernel.org>, "stable"<stable@vger.kernel.org>
Date: Thu, 06 Aug 2026 19:10:59 +0530
Subject: [PATCH] ACPI: pfr_update: fix stack buffer overflow in query_capability()
> query_capability() copies four ACPI buffer objects returned by the
> firmware _DSM into fixed-size u8[16] fields in struct
> pfru_update_cap_info using memcpy with the firmware-supplied length:
>
> memcpy(&cap_hdr->code_type,
> elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> elements[CAP_CODE_TYPE_IDX].buffer.length);
>
> The same pattern repeats for drv_type, platform_id, and oem_id.
> If the firmware returns buffer.length > 16 for any of these fields,
> memcpy writes past the destination array.
>
> struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
> Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
> are generated when a DSM returns 64-byte buffers, with writes reaching
> 44 bytes past the end of cap_hdr's [64, 156) frame window into
> adjacent stack redzones.
>
> Fix by clamping each memcpy length to the size of its destination
> field with min_t(u32, buffer.length, sizeof(cap_hdr->field)).
>
> Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
> ---
> drivers/acpi/pfr_update.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> index 6283105bb0e8..0219347cd78f 100644
> --- a/drivers/acpi/pfr_update.c
> +++ b/drivers/acpi/pfr_update.c
> @@ -161,24 +161,28 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
> cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
> memcpy(&cap_hdr->code_type,
> out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length,
> + sizeof(cap_hdr->code_type)));
> cap_hdr->fw_version =
> out_obj->package.elements[CAP_FW_VER_IDX].integer.value;
> cap_hdr->code_rt_version =
> out_obj->package.elements[CAP_CODE_RT_VER_IDX].integer.value;
> memcpy(&cap_hdr->drv_type,
> out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length,
> + sizeof(cap_hdr->drv_type)));
> cap_hdr->drv_rt_version =
> out_obj->package.elements[CAP_DRV_RT_VER_IDX].integer.value;
> cap_hdr->drv_svn =
> out_obj->package.elements[CAP_DRV_SVN_IDX].integer.value;
> memcpy(&cap_hdr->platform_id,
> out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length,
> + sizeof(cap_hdr->platform_id)));
> memcpy(&cap_hdr->oem_id,
> out_obj->package.elements[CAP_OEM_ID_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length,
> + sizeof(cap_hdr->oem_id)));
> cap_hdr->oem_info_len =
> out_obj->package.elements[CAP_OEM_INFO_IDX].buffer.length;
>
> --
> 2.55.0
>
On Thu, Aug 6, 2026 at 5:17 PM Anirudh Prasad <icarus@a0rg.com> wrote:
>
> > If the firmware wants the kernel to copy more data than the latter has
> > room for, the operation should fail instead of pretending to succeed.
>
> Agreed. v2 validates all four buffer lengths upfront and returns
> -EINVAL if any exceeds its destination field size.
Can you please resend this afresh with proper versioning?
> ---
>
> query_capability() copies four ACPI buffer objects returned by the
> firmware _DSM into fixed-size u8[16] fields in struct
> pfru_update_cap_info using memcpy with the firmware-supplied length:
>
> memcpy(&cap_hdr->code_type,
> elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> elements[CAP_CODE_TYPE_IDX].buffer.length);
>
> The same pattern repeats for drv_type, platform_id, and oem_id.
> If the firmware returns buffer.length > 16 for any of these fields,
> memcpy writes past the destination array.
>
> struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
> Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
> are generated when a DSM returns 64-byte buffers, with writes reaching
> 44 bytes past the end of cap_hdr's [64, 156) frame window into
> adjacent stack redzones.
>
> Fix by validating each buffer length against its destination field
> size before copying, and returning -EINVAL if the firmware supplies
> an oversized buffer.
>
> Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
> ---
> drivers/acpi/pfr_update.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> index 6283105bb0e8..e14e053cea44 100644
> --- a/drivers/acpi/pfr_update.c
> +++ b/drivers/acpi/pfr_update.c
> @@ -158,6 +158,14 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
> goto free_acpi_buffer;
> }
>
> + if (out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length > sizeof(cap_hdr->code_type) ||
> + out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length > sizeof(cap_hdr->drv_type) ||
> + out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length > sizeof(cap_hdr->platform_id) ||
> + out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length > sizeof(cap_hdr->oem_id)) {
> + ret = -EINVAL;
> + goto free_acpi_buffer;
> + }
> +
> cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
> memcpy(&cap_hdr->code_type,
> out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> --
> 2.55.0
>
>
>
>
>
> From: Anirudh Prasad <icarus@a0rg.com>
> To: "linux-acpi"<linux-acpi@vger.kernel.org>
> Cc: "rafaeljwysocki"<rafael.j.wysocki@intel.com>, "linux-kernel"<linux-kernel@vger.kernel.org>, "stable"<stable@vger.kernel.org>
> Date: Thu, 06 Aug 2026 19:10:59 +0530
> Subject: [PATCH] ACPI: pfr_update: fix stack buffer overflow in query_capability()
>
> > query_capability() copies four ACPI buffer objects returned by the
> > firmware _DSM into fixed-size u8[16] fields in struct
> > pfru_update_cap_info using memcpy with the firmware-supplied length:
> >
> > memcpy(&cap_hdr->code_type,
> > elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> > elements[CAP_CODE_TYPE_IDX].buffer.length);
> >
> > The same pattern repeats for drv_type, platform_id, and oem_id.
> > If the firmware returns buffer.length > 16 for any of these fields,
> > memcpy writes past the destination array.
> >
> > struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
> > Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
> > are generated when a DSM returns 64-byte buffers, with writes reaching
> > 44 bytes past the end of cap_hdr's [64, 156) frame window into
> > adjacent stack redzones.
> >
> > Fix by clamping each memcpy length to the size of its destination
> > field with min_t(u32, buffer.length, sizeof(cap_hdr->field)).
> >
> > Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
> > ---
> > drivers/acpi/pfr_update.c | 12 ++++++++----
> > 1 file changed, 8 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> > index 6283105bb0e8..0219347cd78f 100644
> > --- a/drivers/acpi/pfr_update.c
> > +++ b/drivers/acpi/pfr_update.c
> > @@ -161,24 +161,28 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
> > cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
> > memcpy(&cap_hdr->code_type,
> > out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> > - out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length);
> > + min_t(u32, out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length,
> > + sizeof(cap_hdr->code_type)));
> > cap_hdr->fw_version =
> > out_obj->package.elements[CAP_FW_VER_IDX].integer.value;
> > cap_hdr->code_rt_version =
> > out_obj->package.elements[CAP_CODE_RT_VER_IDX].integer.value;
> > memcpy(&cap_hdr->drv_type,
> > out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.pointer,
> > - out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length);
> > + min_t(u32, out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length,
> > + sizeof(cap_hdr->drv_type)));
> > cap_hdr->drv_rt_version =
> > out_obj->package.elements[CAP_DRV_RT_VER_IDX].integer.value;
> > cap_hdr->drv_svn =
> > out_obj->package.elements[CAP_DRV_SVN_IDX].integer.value;
> > memcpy(&cap_hdr->platform_id,
> > out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.pointer,
> > - out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length);
> > + min_t(u32, out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length,
> > + sizeof(cap_hdr->platform_id)));
> > memcpy(&cap_hdr->oem_id,
> > out_obj->package.elements[CAP_OEM_ID_IDX].buffer.pointer,
> > - out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length);
> > + min_t(u32, out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length,
> > + sizeof(cap_hdr->oem_id)));
> > cap_hdr->oem_info_len =
> > out_obj->package.elements[CAP_OEM_INFO_IDX].buffer.length;
> >
> > --
> > 2.55.0
> >
>
>
On Thu, Aug 6, 2026 at 3:41 PM Anirudh Prasad <icarus@a0rg.com> wrote:
>
> query_capability() copies four ACPI buffer objects returned by the
> firmware _DSM into fixed-size u8[16] fields in struct
> pfru_update_cap_info using memcpy with the firmware-supplied length:
>
> memcpy(&cap_hdr->code_type,
> elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> elements[CAP_CODE_TYPE_IDX].buffer.length);
>
> The same pattern repeats for drv_type, platform_id, and oem_id.
> If the firmware returns buffer.length > 16 for any of these fields,
> memcpy writes past the destination array.
>
> struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
> Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
> are generated when a DSM returns 64-byte buffers, with writes reaching
> 44 bytes past the end of cap_hdr's [64, 156) frame window into
> adjacent stack redzones.
>
> Fix by clamping each memcpy length to the size of its destination
> field with min_t(u32, buffer.length, sizeof(cap_hdr->field)).
>
> Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
If the firmware wants the kernel to copy more data than the latter has
room for, the operation should fail instead of pretending to succeed.
> ---
> drivers/acpi/pfr_update.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> index 6283105bb0e8..0219347cd78f 100644
> --- a/drivers/acpi/pfr_update.c
> +++ b/drivers/acpi/pfr_update.c
> @@ -161,24 +161,28 @@ static int query_capability(struct pfru_update_cap_info *cap_hdr,
> cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
> memcpy(&cap_hdr->code_type,
> out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length,
> + sizeof(cap_hdr->code_type)));
> cap_hdr->fw_version =
> out_obj->package.elements[CAP_FW_VER_IDX].integer.value;
> cap_hdr->code_rt_version =
> out_obj->package.elements[CAP_CODE_RT_VER_IDX].integer.value;
> memcpy(&cap_hdr->drv_type,
> out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length,
> + sizeof(cap_hdr->drv_type)));
> cap_hdr->drv_rt_version =
> out_obj->package.elements[CAP_DRV_RT_VER_IDX].integer.value;
> cap_hdr->drv_svn =
> out_obj->package.elements[CAP_DRV_SVN_IDX].integer.value;
> memcpy(&cap_hdr->platform_id,
> out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length,
> + sizeof(cap_hdr->platform_id)));
> memcpy(&cap_hdr->oem_id,
> out_obj->package.elements[CAP_OEM_ID_IDX].buffer.pointer,
> - out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length);
> + min_t(u32, out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length,
> + sizeof(cap_hdr->oem_id)));
> cap_hdr->oem_info_len =
> out_obj->package.elements[CAP_OEM_INFO_IDX].buffer.length;
>
> --
> 2.55.0
>
© 2016 - 2026 Red Hat, Inc.