From 7488f3e0732b9226dbcaa09c74d14443a14de7a5 Mon Sep 17 00:00:00 2001 From: Mohamad El Harake Date: Fri, 10 Apr 2026 00:41:58 +0300 Subject: [PATCH] media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsm gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as key/value pairs using obj->package.count - 1 as the loop bound. If package.count is 0, the subtraction underflows and may lead to out-of-bounds access. Use i + 1 < obj->package.count instead. Signed-off-by: Mohamad El Harake Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus --- drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c index ba61cc28fac1..cca91c6d71a5 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c +++ b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c @@ -113,7 +113,7 @@ static char *gmin_cfg_get_dsm(struct acpi_device *adev, const char *key) if (!obj) return NULL; - for (i = 0; i < obj->package.count - 1; i += 2) { + for (i = 0; i + 1 < obj->package.count; i += 2) { key_el = &obj->package.elements[i + 0]; val_el = &obj->package.elements[i + 1];