platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing

The hp_populate_*_elements_from_package() functions in the hp-bioscfg
driver contain out-of-bounds array access vulnerabilities.

These functions parse ACPI packages into internal data structures using
a for loop with index variable 'elem' that iterates through
enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.

When processing multi-element fields like PREREQUISITES and
ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array
elements using expressions like 'enum_obj[elem + reqs]' and
'enum_obj[elem + pos_values]' within nested loops.

The bug is that the bounds check only validated elem, but did not consider
the additional offset when accessing elem + reqs or elem + pos_values.

The fix changes the bounds check to validate the actual accessed index.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

diff --git a/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
index c50ad58805038ecb7deb009740ca63b4ec35e2d1..f346aad8e9d89598ab293a4fa0fb19197d5d62d2 100644 (file)
--- a/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
@@ -207,7 +207,7 @@ static int hp_populate_enumeration_elements_from_package(union acpi_object *enum
                case PREREQUISITES:
                        size = min_t(u32, enum_data->common.prerequisites_size, MAX_PREREQUISITES_SIZE);
                        for (reqs = 0; reqs < size; reqs++) {
-                               if (elem >= enum_obj_count) {
+                               if (elem + reqs >= enum_obj_count) {
                                        pr_err("Error enum-objects package is too small\n");
                                        return -EINVAL;
                                }
@@ -255,7 +255,7 @@ static int hp_populate_enumeration_elements_from_package(union acpi_object *enum
 
                        for (pos_values = 0; pos_values < size && pos_values < MAX_VALUES_SIZE;
                             pos_values++) {
-                               if (elem >= enum_obj_count) {
+                               if (elem + pos_values >= enum_obj_count) {
                                        pr_err("Error enum-objects package is too small\n");
                                        return -EINVAL;
                                }

diff --git a/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
index 6c7f4d5fa9cb9c1cdb2f10f32f0d2226216c1efd..63b1fda2be4e20ad1b9d4452fa141f115dc882bf 100644 (file)
--- a/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
@@ -227,7 +227,7 @@ static int hp_populate_integer_elements_from_package(union acpi_object *integer_
                        size = min_t(u32, integer_data->common.prerequisites_size, MAX_PREREQUISITES_SIZE);
 
                        for (reqs = 0; reqs < size; reqs++) {
-                               if (elem >= integer_obj_count) {
+                               if (elem + reqs >= integer_obj_count) {
                                        pr_err("Error elem-objects package is too small\n");
                                        return -EINVAL;
                                }

diff --git a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
index c6e57bb9d8b74d5ffa9c777c209a5b77102e024c..6a31f47ce3f5b7e17bc8e614fc2bdeee6f11e807 100644 (file)
--- a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
@@ -216,6 +216,11 @@ static int hp_populate_ordered_list_elements_from_package(union acpi_object *ord
                        size = min_t(u32, ordered_list_data->common.prerequisites_size,
                                     MAX_PREREQUISITES_SIZE);
                        for (reqs = 0; reqs < size; reqs++) {
+                               if (elem + reqs >= order_obj_count) {
+                                       pr_err("Error elem-objects package is too small\n");
+                                       return -EINVAL;
+                               }
+
                                ret = hp_convert_hexstr_to_str(order_obj[elem + reqs].string.pointer,
                                                               order_obj[elem + reqs].string.length,
                                                               &str_value, &value_len);

diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 187b372123ed39430c902a4634c25aa53251564a..ec79d9d50377af770767a5e7a74e1665f727a03a 100644 (file)
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -303,6 +303,11 @@ static int hp_populate_password_elements_from_package(union acpi_object *passwor
                                     MAX_PREREQUISITES_SIZE);
 
                        for (reqs = 0; reqs < size; reqs++) {
+                               if (elem + reqs >= password_obj_count) {
+                                       pr_err("Error elem-objects package is too small\n");
+                                       return -EINVAL;
+                               }
+
                                ret = hp_convert_hexstr_to_str(password_obj[elem + reqs].string.pointer,
                                                               password_obj[elem + reqs].string.length,
                                                               &str_value, &value_len);

diff --git a/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
index 27758b779b2d3ccb18445b508914e2f7d9a5fce3..7b885d25650c5264c269fb73e4389d5e23596ebb 100644 (file)
--- a/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
@@ -217,7 +217,7 @@ static int hp_populate_string_elements_from_package(union acpi_object *string_ob
                                     MAX_PREREQUISITES_SIZE);
 
                        for (reqs = 0; reqs < size; reqs++) {
-                               if (elem >= string_obj_count) {
+                               if (elem + reqs >= string_obj_count) {
                                        pr_err("Error elem-objects package is too small\n");
                                        return -EINVAL;
                                }