From: Tristan Madani acer_gsensor_event() accesses the ACPI evaluation result as a package without first verifying the object type. If the firmware returns a non-package type, the code reads package.count and package.elements from the wrong union member, which can cause a NULL pointer dereference or read from an invalid address. Add a type check for ACPI_TYPE_PACKAGE before accessing the package fields, and validate that each element is ACPI_TYPE_INTEGER before reading integer.value. Fixes: 1eb3fe1d3b6b ("ACER: Add support for accelerometer sensor") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/platform/x86/acer-wmi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c index 61ae622c93d94..72b44f02a992f 100644 --- a/drivers/platform/x86/acer-wmi.c +++ b/drivers/platform/x86/acer-wmi.c @@ -2043,7 +2043,12 @@ static int acer_gsensor_event(void) if (ACPI_FAILURE(status)) return -1; - if (out_obj->package.count != 4) + if (out_obj->type != ACPI_TYPE_PACKAGE || out_obj->package.count != 4) + return -1; + + if (out_obj->package.elements[0].type != ACPI_TYPE_INTEGER || + out_obj->package.elements[1].type != ACPI_TYPE_INTEGER || + out_obj->package.elements[2].type != ACPI_TYPE_INTEGER) return -1; input_report_abs(acer_wmi_accel_dev, ABS_X, -- 2.47.3