linux-toradex.git/drivers/acpi/acpica, branch master

ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias

2026-07-01T10:29:24+00:00

Commit 292db66afd20 ("ACPICA: Unbreak tools build after switching over
to strscpy_pad()") added an #ifdef based on a __KERNEL__ check which is
sort of nasty to the acpi_ut_safe_strncpy() definition to unbreak ACPICA
tools builds broken by commit 97f7d3f9c9ac ("ACPICA: Replace strncpy()
with strscpy_pad() in acpi_ut_safe_strncpy()").  However, that #ifdef
effectively produces dead code when tools are built because they don't
call acpi_ut_safe_strncpy().

Accordingly, drop the existing definition of acpi_ut_safe_strncpy() and
define it as a strscpy_pad() alias.

Fixes: 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()")
Signed-off-by: Rafael J. Wysocki 
[ rjw: Tweak the changelog ]
Link: https://patch.msgid.link/12941764.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki

ACPICA: Unbreak tools build after switching over to strscpy_pad()

2026-06-24T13:02:29+00:00

Commit 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in
acpi_ut_safe_strncpy()") switched over the ACPICA code in the kernel to
using strscpy_pad() instead of a combination of strncpy() and manual
NUL-termination of the destination string, but it overlooked the fact
that tools also use the code in question and strscpy_pad() is not
defined in those builds.

Address that by using the original ACPICA code in non-kernel builds.

Fixes: 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()")
Reported-by: Jiri Slaby 
Closes: https://lore.kernel.org/all/79e9e913-0fb1-4110-804b-c3b5d0edafe4@kernel
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Kees Cook 
[ rjw: Fixed up the number of added code lines ]
Link: https://patch.msgid.link/12923581.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki

Merge branch 'acpica'

2026-06-11T12:57:55+00:00

Merge ACPICA updates for 7.2-rc1 including the following changes:

 - Add support for the Legacy Virtual Register (LVR) field in I2C serial
   bus resource descriptors to ACPICA (Akhil R)

 - Fix multiple issues related to bounds checks, input validation,
   use-after-free, and integer overflow checks in the AML interpreter
   in ACPICA (ikaros)

 - Update the copyright year to 2026 in ACPICA files and make minor
   changes related to ACPI 6.6 support (Pawel Chmielewski)

 - Remove spurious precision from format used to dump parse trees in
   ACPICA (David Laight)

 - Add modern standby DSM GUIDs to ACPICA header files (Daniel Schaefer)

 - Fix FADT 32/64X length mismatch warning in ACPICA (Abdelkader Boudih)

 - Update D3hot/cold device power states definitions in ACPICA header
   files (Aymeric Wibo)

 - Fix NULL pointer dereference in acpi_ns_custom_package() (Weiming
   Shi)

 - Update ACPICA version to 20260408 (Saket Dumbre)

* acpica: (27 commits)
  ACPICA: add boundary checks in two places
  ACPICA: Add package limit checks in parser functions
  ACPICA: Update version to 20260408
  ACPICA: Update the copyright year to 2026
  ACPICA: Remove spurious precision from format used to dump parse trees
  ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
  ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
  ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
  ACPICA: Add validation for node in acpi_ns_build_normalized_path()
  ACPICA: validate handler object type in two places
  ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
  ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
  ACPICA: Prevent adding invalid references
  ACPICA: add boundary checks in acpi_ps_get_next_field()
  ACPICA: validate byte_count in acpi_ps_get_next_package_length()
  ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
  ACPICA: fix I2C LVR item count in the conversion table
  ACPICA: Mention the LVR bits
  ACPICA: Change LVR to 8 bit value
  ACPICA: Fetch LVR I2C resource descriptor
  ...

ACPICA: add boundary checks in two places

2026-05-27T18:18:47+00:00

Add boundary checks in acpi_ps_get_next_namestring() and
acpi_ps_peek_opcode() to prevent out-of-bounds access.

Link: https://github.com/acpica/acpica/commit/cfdc96896d8d
Signed-off-by: ikaros 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/5180044.0VBMTVartN@rafael.j.wysocki

ACPICA: Add package limit checks in parser functions

2026-05-27T18:18:47+00:00

Add package limit checks in parser functions to prevent out-of-bounds
access.

Link: https://github.com/acpica/acpica/commit/b31b45af2122
Signed-off-by: ikaros 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/3212937.CbtlEUcBR6@rafael.j.wysocki

ACPICA: Update the copyright year to 2026

2026-05-27T18:18:47+00:00

Update copyright notices in all ACPICA files.

Link: https://github.com/acpica/acpica/commit/9def02549a9c
Signed-off-by: Pawel Chmielewski 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/4379132.1IzOArtZ34@rafael.j.wysocki

ACPICA: Remove spurious precision from format used to dump parse trees

2026-05-27T18:18:46+00:00

The debug code in acpi_ps_delete_parse_tree() uses ("%*.s", level * 4, " ")
to indent traces.

POSIX requires the empty precision be treated as zero, but the kernel treats
is as 'no precision specified'.

Change to ("%*s", level * 4, "") since there is additional whitespace and no
reason to indent by one space when level is zero.

Link: https://github.com/acpica/acpica/commit/a87038098af6
Signed-off-by: David Laight 
Signed-off-by: Pawel Chmielewski 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/2914242.BEx9A2HvPv@rafael.j.wysocki

ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()

2026-05-27T18:18:46+00:00

Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() to
prevent buffer overflows.

Link: https://github.com/acpica/acpica/commit/f85a43098d65
Signed-off-by: ikaros 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki

ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()

2026-05-27T18:18:46+00:00

acpi_ns_custom_package() unconditionally dereferences the first element
of the package to read the _BIX version number, without checking for
NULL:

    if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)

When firmware returns a _BIX package whose first element is an
unresolvable reference, ACPICA evaluates that entry to NULL.
acpi_ns_remove_null_elements() does not strip NULL entries for
ACPI_PTYPE_CUSTOM packages (fixed-position format would break if
elements were shifted), so acpi_ns_custom_package() sees the NULL
and causes a crash.

Add a NULL check for the first element (version field) before
dereferencing it. The caller then receives AE_AML_OPERAND_TYPE
instead of crashing.

Link: https://github.com/acpica/acpica/commit/f3f111b9013b
Reported-by: Xiang Mei 
Reported-by: Weiming Shi 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki

ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()

2026-05-27T18:18:46+00:00

Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent
buffer overflows.

Link: https://github.com/acpica/acpica/commit/975cb20c7992
Signed-off-by: ikaros 
Signed-off-by: Rafael J. Wysocki 
Link: https://patch.msgid.link/2481429.NG923GbCHz@rafael.j.wysocki