ACPICA: validate handler object type in two places

ACPICA: validate handler object type in acpi_ev_has_default_handler()
and acpi_ev_find_region_handler().

Link: https://github.com/acpica/acpica/commit/f6fc648a1389
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki

diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c
index 5a35dae945e207690858428323901d7fd4d936e1..f16c1148e602e0b75c00c1146d6266834604d20b 100644 (file)
--- a/drivers/acpi/acpica/evhandler.c
+++ b/drivers/acpi/acpica/evhandler.c
@@ -130,6 +130,14 @@ acpi_ev_has_default_handler(struct acpi_namespace_node *node,
                /* Walk the linked list of handlers for this object */
 
                while (handler_obj) {
+
+                       /* Validate handler object type before accessing fields */
+
+                       if (handler_obj->common.type !=
+                           ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+                               break;
+                       }
+
                        if (handler_obj->address_space.space_id == space_id) {
                                if (handler_obj->address_space.handler_flags &
                                    ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {
@@ -292,6 +300,9 @@ union acpi_operand_object *acpi_ev_find_region_handler(acpi_adr_space_type
        /* Walk the handler list for this device */
 
        while (handler_obj) {
+               if (handler_obj->common.type != ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+                       break;
+               }
 
                /* Same space_id indicates a handler is installed */