From nobody Mon May 25 03:55:41 2026 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C73253B3892 for ; Tue, 19 May 2026 07:00:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779174049; cv=none; b=rxWbnLm/TgJAekWbC9QycHJXJez8DTvx8uSjvDtO/LT+oqt/XPAQRJHscAwGnDe66hTZzQ4XF1RcNRLGEJYvRAk5Q6Cxz2q3wKY/JGuomjqqCrRCujyzGJbBNZfdC1NjWzeDxyhCh6yHpkakxouIOIGfnQv78b5+R3Yxz49HSxY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779174049; c=relaxed/simple; bh=ZSp/z1Tj1Jrmgu4eL15wfq9HJ2Umx5HE6Vy5deEwP90=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=R9tlhV2DamLBXrE7dRI43v+Cd7+4AD5bkArEuL7+Vb4mqcxNPgbUW5eebADFqyBj4U8USoWb1ve2wthvif9LdK/cFm945Yjn9+S6Bu21cU5mrKIqNt+wSK4HKtl6UhFaZckYuqA4v/YjCgbRJG+7KGkXL07d4OmVUQX7+CMetfU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QZACryWA; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QZACryWA" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-488ad135063so23822245e9.0 for ; Tue, 19 May 2026 00:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779174046; x=1779778846; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=7jiHQAOvHLYgdNNqQrTT3RCJkY+Y4TVhMjJVagFdqfs=; b=QZACryWAEj13f+h5914xQ/BU5TFOZzht+7a9UIk0Fu/m51/KPbipQlUqNPm9c9xo5Z oa7RUwgsJuIAqjqX6cZPBCSrQb6GFDfX5XbgY9oUc3V6e1qP2ZYrKpTzxtKj/6DfNy6R M9cKdCXsL/BJ5GWj9u6u0tMF1B3vFtoTOyrj04jhLjmrt+ok2Ek+1TK/xHKjnxBRYbt8 4sMEymqH0FE+Eo4wsWZKubwIGZ31IGj54w5KG2XLm6+LsmFIaabhcc4X9bVUbe0P4qKU KeBhASqhX3BsBcz730Dl7o4hmrwM/BNXBNAALvLoCng3ruL7cxtwcqqVareF2yNv6RdA zpFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779174046; x=1779778846; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=7jiHQAOvHLYgdNNqQrTT3RCJkY+Y4TVhMjJVagFdqfs=; b=c3mIFv8p/WYd1KnjbLYAmxD1PqD93kU5SgqO11U4fhG4/po84qDACduXOZmDeAh5KN /IGsQOruR6mj51An3Fgiid+L0DeQm5NaaR7GIdEF88worw4JOk20qxF5I+nGjaqPnsYg 5oxeJ0wb4pktNR6DdnzW8/OPtPEVNHrxlYWTVKmZZUguGcvBmHBI0fJMUACDCaL1UGu/ aYZjOBOfhSpD3saDAt8krb/Q9n7RnVa5bm2kKPOSYh/8kGFCdnfvMTEvZ5JXxKAy7YRL mA1vzbFEFgaIiGhgRwWiKIC46I3CadqlvhNJxd9Gi1SUARUIjY/TQRTwHEKGat16nU8j bsJQ== X-Forwarded-Encrypted: i=1; AFNElJ/L7G8CWTlCIxuLJittqzjrB0wPSjqe8ug5LO/nVGWGpEa1wzr+/VJGkY8MQeVXI6TLyTsbkh6ebfmuQMQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yz62JF4bsFZX1tMoX4zNBz+dRNqRWQpfmQc0K3InIYNfBn4hS8h cCo2Iiir2jf1+hrXqnTh9L5CXz3ZuNiz5r1OdwqyFsk+8xNMZROhIEEt X-Gm-Gg: Acq92OFeNgULNXPacfa14ZVMu0R5o5xFPjxc+jrKuhokCcFU0Osu/mRxfT7QFh7VBMp 45LX3Ho2HuJNomNQ25ww/CNpIHxg2DXM9nlzvo3k0cmVtaFFhijkzLtFo12AxHa29ngRvg6gPiE LZ76zBnZzVyCCylwbTR0Ulgd/hQwa9jR3NhggeePXEN0Aa6ra2ZacBgFJK/mBCzmSQluTzlnoLI UUy4uTST0FBQbeoV39abM/2fjt/Y96bTkcmzFO+kcaU1AjWsn48FHrqMqcEQboWyoI/8LRk7T+h d9l63zwnMN6uSids/o6M1N8Nnkym6gdWHAQqdIw025g3Q2izE4eECj2iK8ivzEuxG8bqUFxYoVA h5GYPyNAS4fGAo7PJ9T/fxVfYctHehalmshhdzNzVsvn+EVCT2gdoZS72RJrszdMipJ+eu8/65Y aGZvaBVNBA1OTCUtGWWAkL8r5Se/eS6w== X-Received: by 2002:a05:600c:4692:b0:48f:d5b8:5b07 with SMTP id 5b1f17b1804b1-48fe63253e0mr289793925e9.20.1779174045400; Tue, 19 May 2026 00:00:45 -0700 (PDT) Received: from G614PR ([2a01:e11:202b:40:328e:213e:a3da:580f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48feb029180sm149177055e9.4.2026.05.19.00.00.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 00:00:44 -0700 (PDT) From: "Marco Scardovi (scardracs)" To: mika.westerberg@linux.intel.com Cc: andriy.shevchenko@linux.intel.com, brgl@kernel.org, linusw@kernel.org, linux-acpi@vger.kernel.org, linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org, mscardovi95@gmail.com, westeri@kernel.org Subject: [PATCH 1/2] gpiolib: acpi: Add robust bounds-checking for GPIO pin resources Date: Tue, 19 May 2026 09:00:30 +0200 Message-ID: <20260519070039.9280-2-mscardovi95@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260519070039.9280-1-mscardovi95@gmail.com> References: <20260518103302.GO84797@black.igk.intel.com> <20260519070039.9280-1-mscardovi95@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Ensure that the GPIO pin resource arrays are safely bounded before accessing indices. Add bounds checking in acpi_request_own_gpiod(), acpi_gpio_irq_is_wake(), acpi_gpiochip_alloc_event(), and acpi_gpio_adr_space_handler() to prevent out-of-bounds array reads if the ACPI namespace provides malformed or empty pin tables. Assisted-by: Antigravity:gemini-3-flash Signed-off-by: Marco Scardovi --- drivers/gpio/gpiolib-acpi-core.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-c= ore.c index eb8a40cfb7a9..d381631ba6f0 100644 --- a/drivers/gpio/gpiolib-acpi-core.c +++ b/drivers/gpio/gpiolib-acpi-core.c @@ -322,9 +322,14 @@ static struct gpio_desc *acpi_request_own_gpiod(struct= gpio_chip *chip, { int polarity =3D GPIO_ACTIVE_HIGH; enum gpiod_flags flags =3D acpi_gpio_to_gpiod_flags(agpio, polarity); - unsigned int pin =3D agpio->pin_table[index]; + unsigned int pin; struct gpio_desc *desc; =20 + if (index >=3D agpio->pin_table_length) + return ERR_PTR(-EINVAL); + + pin =3D agpio->pin_table[index]; + desc =3D gpiochip_request_own_desc(chip, pin, label, polarity, flags); if (IS_ERR(desc)) return desc; @@ -337,7 +342,12 @@ static struct gpio_desc *acpi_request_own_gpiod(struct= gpio_chip *chip, static bool acpi_gpio_irq_is_wake(struct device *parent, const struct acpi_resource_gpio *agpio) { - unsigned int pin =3D agpio->pin_table[0]; + unsigned int pin; + + if (agpio->pin_table_length =3D=3D 0) + return false; + + pin =3D agpio->pin_table[0]; =20 if (agpio->wake_capable !=3D ACPI_WAKE_CAPABLE) return false; @@ -367,6 +377,9 @@ static acpi_status acpi_gpiochip_alloc_event(struct acp= i_resource *ares, if (!acpi_gpio_get_irq_resource(ares, &agpio)) return AE_OK; =20 + if (agpio->pin_table_length =3D=3D 0) + return AE_OK; + handle =3D ACPI_HANDLE(chip->parent); pin =3D agpio->pin_table[0]; =20 @@ -1110,6 +1123,11 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physi= cal_address address, return AE_BAD_PARAMETER; } =20 + if (pin_index >=3D agpio->pin_table_length) { + ACPI_FREE(ares); + return AE_BAD_PARAMETER; + } + length =3D min(agpio->pin_table_length, pin_index + bits); for (i =3D pin_index; i < length; ++i) { unsigned int pin =3D agpio->pin_table[i]; --=20 2.54.0 From nobody Mon May 25 03:55:41 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A4FB3B2FF5 for ; Tue, 19 May 2026 07:00:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779174050; cv=none; b=alSqmwMgfJhSTRQQ+qoqlN8yChVsaZwdD2SlAF2ZdC5Od/AigtttvB/bnLSfnmsN7PxgAl1YPD+sBV9a6a8yKhfSh+N91k5ukUGmxxmtvqPsrj91aEERouaVzqexenqIVeXm9/3pviEQd98QqLb7RlY8dVHZy3rUL5HIPqI0T2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779174050; c=relaxed/simple; bh=ZO+sueJVrR69Zhx9fYyKQVNvrfhpta1Aq5px2+ybHl8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mSc9dVmpLoJL7omjnkMyJ6MrHlUNoLg6jXkpYp+C271i9rG4e90BJB9x3QhWCltni5XgFnHEUuK4iz4jxlzc5BslyZGhNfg5TTP+63jqlaxibeTtGx/YnPF7AxQ7HwDGMe7CQc8tC4fr+b3dHIHmy8WvqcTUdGdKl/X+s7BLNQ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SYqobdPY; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SYqobdPY" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-48d146705b4so34037605e9.3 for ; Tue, 19 May 2026 00:00:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779174047; x=1779778847; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ZaZKCHeIzJcYq9VGQ5atd5s4RbOR0sd+cuGJOBOqccs=; b=SYqobdPYf3U9cm+blOFuda9VMItNavprmCoFhDxJRbqEaLZj+OArQ4CaywgKRotCd9 0CV9Rm5rAEDR8uY1S/bW2sqM07of+hXOmwZ81thO5mLoGJr0a26rTqgY5wsRX1Wx5dYg LBADCVhzel30E1gU94rEp/PrzhLKcmDdLPbKZL3b+gTYe/1zBPJBuFG+zidQPuKo0y3O ywz4zKvjDaNA0JsdpdGuVmJVWRVZL+rekhpK63hV9RZmSSnbOj5646mvpbKMHF0+tq7L P7MiGQ17qiJcDG17U0kDcSkroDq+skGF2WDFz9F+khKN54epcAe2dU/jpUV76bpOTcty rk1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779174047; x=1779778847; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=ZaZKCHeIzJcYq9VGQ5atd5s4RbOR0sd+cuGJOBOqccs=; b=f7Fo/QB0LDjyq35ZToHt19RO+eucLQhmFslZNiGLb6jbREUhGajt9gixRXZS1CGgzM HXmoZiO/A1WauHgpd7PbpHpg8uVaj9rbO6db9OTysi8lbGMto//zdyC5vpmENs1GCiLv MeDsnkiHT/4BZFFET1A5xAgwJj7EHMLW3vuepV1zrkj5Pg3KopHd2/K/bk4z+b1xemKs SNZaqpXtTHrUESTH+5Hvq5bPG1mM5GsuNnKGzadauRMJYk6HdbCBaF7jioedA1mIDj+U EpeFaRIhPzH7XBXilaJyAn0pFV7HJuesP90WZxKaDe00ITiE+ZSAsIm/NuxjOw09F8so rTrg== X-Forwarded-Encrypted: i=1; AFNElJ92nWRwL7AQlDPmeQJ7x488kO7wRGIS3aEOqi5y7TKBHL6aJHWmwSkY7sBhWT/IqTmxWcOFaeOpe78SthU=@vger.kernel.org X-Gm-Message-State: AOJu0Yxv6hmx2yD7WOdg9cUbmHBCRLO4Q2tvR8Bt8D6zvi1TMQGF1hu/ YVgYwxmwYCofLtJEKoHhT2SnzHxxiuCbQMWz656MPafkVpTNCsfIpYDO X-Gm-Gg: Acq92OGhOTPS4JSv7YAfo8yvk1TJs2MK2X+s4GMJ71M5GAn/YPM6R4n0qApUkhh00CE u7yDrzfcD8UxlJaXVLmxyrQSbMwLn0CcUnAc7K83lqSAzt1OlHpeXlvgBfmCgqQpBgUlzQEu6TI 8RjMb8GD4E3LUL/lu2cMHSMZcEDYOmcUl0Uz7Cwf9LS7rv47zmHXoXkEMk/rk3EBoDDOk++pTuM e9s83taledsT7VY0IW1aLpV/gGXbAEDNgxXJ1/fIrRaEsCZM1m+3Ny8BuTYC/zQkS2TVESiElGD qDn9QMrPap17h4m3r+q08cz68w6kO3faQFJFWtDOrTIpbxd4kawXRTg5qM3IO+v/p9TVpWq3g0Y Flr/jgvvc1tdeY5DWgNPylwW8Tgxght0rVrLYBe5hvOQ0oRmHAxz++Di/R4IMNU9fgZsfHcSm4S 8MTJULeRMCxqn2WqcK/tk= X-Received: by 2002:a05:600c:a406:b0:487:1fb4:7e1 with SMTP id 5b1f17b1804b1-48fe632a02fmr239198495e9.22.1779174046426; Tue, 19 May 2026 00:00:46 -0700 (PDT) Received: from G614PR ([2a01:e11:202b:40:328e:213e:a3da:580f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48feb029180sm149177055e9.4.2026.05.19.00.00.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 00:00:45 -0700 (PDT) From: "Marco Scardovi (scardracs)" To: mika.westerberg@linux.intel.com Cc: andriy.shevchenko@linux.intel.com, brgl@kernel.org, linusw@kernel.org, linux-acpi@vger.kernel.org, linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org, mscardovi95@gmail.com, westeri@kernel.org Subject: [PATCH 2/2] gpiolib: acpi: Fix resource leak in OpRegion cleanup path Date: Tue, 19 May 2026 09:00:31 +0200 Message-ID: <20260519070039.9280-3-mscardovi95@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260519070039.9280-1-mscardovi95@gmail.com> References: <20260518103302.GO84797@black.igk.intel.com> <20260519070039.9280-1-mscardovi95@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If acpi_remove_address_space_handler() fails, the cleanup function acpi_gpiochip_free_regions() previously returned early. This leaks the connections list and all requested GPIO descriptors. Remove the early return statement so that connection cleanup and freeing of descriptors are always executed, preventing memory leaks in teardown failure paths. Assisted-by: Antigravity:gemini-3-flash Signed-off-by: Marco Scardovi --- drivers/gpio/gpiolib-acpi-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-c= ore.c index d381631ba6f0..b6f2af23b204 100644 --- a/drivers/gpio/gpiolib-acpi-core.c +++ b/drivers/gpio/gpiolib-acpi-core.c @@ -1239,7 +1239,6 @@ static void acpi_gpiochip_free_regions(struct acpi_gp= io_chip *achip) if (ACPI_FAILURE(status)) { dev_err(chip->parent, "Failed to remove GPIO OpRegion handler\n"); - return; } =20 list_for_each_entry_safe_reverse(conn, tmp, &achip->conns, node) { --=20 2.54.0