linux-kernel - [PATCH] ACPI: EC: Ignore ECDT tables with an invalid ID string

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250529235310.540530-1-W_Armin@gmx.de>
Date: Fri, 30 May 2025 01:53:10 +0200
From: Armin Wolf <W_Armin@....de>
To: rafael@...nel.org,
	lenb@...nel.org,
	glpnk@...ton.me
Cc: linux-acpi@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] ACPI: EC: Ignore ECDT tables with an invalid ID string

On the MSI Modern 14 C5M the ECDT table contains invalid data:

	UID : 00000000
 GPE Number : 00	/* Invalid, 03 would be correct */
   Namepath : ""	/* Invalid, "\_SB.PCI0.SBRG.EC" would
			 * be correct
			 */

This slows down the EC access as the wrong GPE event is used for
communication. Additionally the ID string is invalid.

Ignore such faulty ECDT tables by verifying that the ID string has
a valid format.

Tested-by: glpnk@...ton.me
Signed-off-by: Armin Wolf <W_Armin@....de>
---
 drivers/acpi/ec.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 6f4203716b53..75c7db8b156a 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -23,8 +23,10 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/list.h>
+#include <linux/printk.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/suspend.h>
 #include <linux/acpi.h>
 #include <linux/dmi.h>
@@ -2031,6 +2033,21 @@ void __init acpi_ec_ecdt_probe(void)
 		goto out;
 	}
 
+	if (!strstarts(ecdt_ptr->id, "\\")) {
+		/*
+		 * The ECDT table on some MSI notebooks contains invalid data, together
+		 * with an empty ID string ("").
+		 *
+		 * Section 5.2.15 of the ACPI specification requires the ID string to be
+		 * a "fully qualified reference to the (...) embedded controller device",
+		 * so this string always has to start with a backslash.
+		 *
+		 * By verifying this we can avoid such faulty ECDT tables in a safe way.
+		 */
+		pr_err(FW_BUG "Ignoring ECDT due to invalid ID string \"%s\"\n", ecdt_ptr->id);
+		goto out;
+	}
+
 	ec = acpi_ec_alloc();
 	if (!ec)
 		goto out;
-- 
2.39.5