Re: [PATCH 1/2] gpiolib: acpi: Add robust bounds-checking for GPIO pin resources

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Tue, May 19, 2026 at 09:00:30AM +0200, Marco Scardovi (scardracs) wrote:
> Ensure that the GPIO pin resource arrays are safely bounded before
> accessing indices. Add bounds checking in acpi_request_own_gpiod(),
> acpi_gpio_irq_is_wake(), acpi_gpiochip_alloc_event(), and
> acpi_gpio_adr_space_handler() to prevent out-of-bounds array reads if
> the ACPI namespace provides malformed or empty pin tables.

...

>  	int polarity = GPIO_ACTIVE_HIGH;
>  	enum gpiod_flags flags = acpi_gpio_to_gpiod_flags(agpio, polarity);
> -	unsigned int pin = agpio->pin_table[index];
> +	unsigned int pin;
>  	struct gpio_desc *desc;

Preserve reversed xmas tree order.

...

>  static bool acpi_gpio_irq_is_wake(struct device *parent,
>  				  const struct acpi_resource_gpio *agpio)
>  {
> -	unsigned int pin = agpio->pin_table[0];
> +	unsigned int pin;
> +
> +	if (agpio->pin_table_length == 0)
> +		return false;
> +
> +	pin = agpio->pin_table[0];

This pin is not used...

>  	if (agpio->wake_capable != ACPI_WAKE_CAPABLE)
>  		return false;

...in the above condition, so, you can move the check and pin assignment even
further.

...

>  	if (!acpi_gpio_get_irq_resource(ares, &agpio))
>  		return AE_OK;

> +	if (agpio->pin_table_length == 0)
> +		return AE_OK;

Move this check after the handle assignment.

>  	handle = ACPI_HANDLE(chip->parent);

>  	pin = agpio->pin_table[0];
>  

While at it, move this blank line to be before pin assignment.

...

> +	if (pin_index >= agpio->pin_table_length) {
> +		ACPI_FREE(ares);
> +		return AE_BAD_PARAMETER;
> +	}

This is bogus. Please, read the code. Do not blindly follow some AI nonsense.

>  	length = min(agpio->pin_table_length, pin_index + bits);
>  	for (i = pin_index; i < length; ++i) {
>  		unsigned int pin = agpio->pin_table[i];

-- 
With Best Regards,
Andy Shevchenko