From: Mohamad El Harake Date: Thu, 9 Apr 2026 21:41:58 +0000 (+0300) Subject: media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsm X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7488f3e0732b9226dbcaa09c74d14443a14de7a5;p=thirdparty%2Fkernel%2Flinux.git media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsm gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as key/value pairs using obj->package.count - 1 as the loop bound. If package.count is 0, the subtraction underflows and may lead to out-of-bounds access. Use i + 1 < obj->package.count instead. Signed-off-by: Mohamad El Harake Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus --- diff --git a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c index ba61cc28fac1..cca91c6d71a5 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c +++ b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c @@ -113,7 +113,7 @@ static char *gmin_cfg_get_dsm(struct acpi_device *adev, const char *key) if (!obj) return NULL; - for (i = 0; i < obj->package.count - 1; i += 2) { + for (i = 0; i + 1 < obj->package.count; i += 2) { key_el = &obj->package.elements[i + 0]; val_el = &obj->package.elements[i + 1];