From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2E437CCF2C1 for ; Fri, 16 Oct 2026 14:37:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: References:In-Reply-To:Subject:Cc:To:From:Message-ID:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=uflAwfv4pgBe00mPZASrj8nK8vm7+mx19rpyox+Hzkk=; b=CWzRBbwbqarX0m28cq/JWRdit4 RMOg7JSBpvpvk8yKM9ZVc9DPsByCLc49dEgPjfnEq80OT3ofYfUxm+Q3CoMDQ5RvqZCDHrVqwc3X9 yMnTWZJsRGK4EYRTFWDBL62pmv2nH9EnxS3a51iCkoh7Wc0zKKl936jtTCPZ9Lwv/YqEA5+PXVyuZ hiCue9GZN+JGSjITAJdWMDEebbviHzYnxDq9BcDsOAEBWLuA98NvG46Zc559DfVDgnaMSXb20gBdh AG7mWMq7PK8CmXX9rMwqyOH8GrPpgG5iquOsN4Yf2x1J6Cen+BKSS5U9rab5Xi2xVfM+s0LuQEHI7 uSM9sEAw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xHj3G-000000039pt-1y8g; Fri, 16 Oct 2026 14:36:54 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xHj3F-000000039pN-2DG1 for linux-arm-kernel@lists.infradead.org; Fri, 16 Oct 2026 14:36:53 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id DEEB9439C0; Fri, 16 Oct 2026 14:36:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1F0D1F000C4; Fri, 16 Oct 2026 14:36:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792161412; bh=uflAwfv4pgBe00mPZASrj8nK8vm7+mx19rpyox+Hzkk=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=hHm9YjaiPam4pOBh45KFrpmp+76rcRCkKwZmdOjW9Q7QCW7vJ+GLhmIG+2LrhraQ/ jYZ6jPUgTOxtyANFNfA9Hrf3jGX5dj0wo7tjWAkhedvR5D2LhzCSR4vuiPQ2KX38Wk e9ARjisbV1UnbuuCHa6RAA1BWvTgVm59XR7zYbPd7mfSC/b2HpaLhntWv7qHiVXK0J 5R6cCLldRhZ/YBzPbNTQtFDnBZ3tnpefVfNXvpWC90ZnOTquajBoM0iR0RPhTAdr7X uPdm0kftJHGYwEIlc3DKpPN0jKU5MdJMFZJEO4CFKdbGWXl1c3wLf704IvnWCOuHmF Dt9H+mSZ4CeOQ== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xHj3C-00000003ndV-2mXh; Fri, 16 Oct 2026 14:36:50 +0000 Date: Fri, 16 Oct 2026 15:36:50 +0100 Message-ID: <868q3x1zlp.wl-maz@kernel.org> From: Marc Zyngier To: Jiale Yao Cc: Thomas Gleixner , Radu Rendec , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 3/6] irqchip/gic-v3: validate MADT records before use In-Reply-To: <20261016141357.2793046-4-yaojiale02@163.com> References: <20261016141357.2793046-1-yaojiale02@163.com> <20261016141357.2793046-4-yaojiale02@163.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: yaojiale02@163.com, tglx@kernel.org, radu@rendec.net, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, 16 Oct 2026 15:13:54 +0100, Jiale Yao wrote: > > The GICv3 ACPI paths cast generic MADT headers to distributor, > redistributor, and CPU interface records before confirming that the > corresponding fixed-size structures are present. Truncated records can > therefore cause out-of-bounds field reads while probing or setting up > virtualization data. > > Check each typed MADT record before its first field access. Also reject > a short distributor record in the version validator, which runs before > the probe callback. > > Signed-off-by: Jiale Yao > --- > drivers/irqchip/irq-gic-v3.c | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > > diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c > index 6e1fa5b247fc..0588d6d83b31 100644 > --- a/drivers/irqchip/irq-gic-v3.c > +++ b/drivers/irqchip/irq-gic-v3.c > @@ -2299,6 +2299,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header, > (struct acpi_madt_generic_redistributor *)header; > void __iomem *redist_base; > > + if (BAD_MADT_ENTRY(redist, end)) > + return -EINVAL; > + > redist_base = ioremap(redist->base_address, redist->length); > if (!redist_base) { > pr_err("Couldn't map GICR region @%llx\n", redist->base_address); > @@ -2325,6 +2328,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header, > u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2; > void __iomem *redist_base; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + > /* Neither enabled or online capable means it doesn't exist, skip it */ > if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE))) > return 0; > @@ -2391,6 +2397,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header, > struct acpi_madt_generic_interrupt *gicc = > (struct acpi_madt_generic_interrupt *)header; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + > /* > * If GICC is enabled and has valid gicr base address, then it means > * GICR base is presented via GICC. The redistributor is only known to > @@ -2437,6 +2446,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header, > int count; > > dist = (struct acpi_madt_generic_distributor *)header; > + if (header->length < sizeof(*dist)) > + return false; > + Why is this open-coded instead of using the checking macro? > if (dist->version != ape->driver_data) > return false; > > @@ -2457,6 +2469,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea > int maint_irq_mode; > static int first_madt = true; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + Why isn't this using BAD_MADT_GICC_ENTRY()? > if (!(gicc->flags & > (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE))) > return 0; > @@ -2547,6 +2562,9 @@ gic_acpi_init(union acpi_subtable_headers *header, const unsigned long end) > > /* Get distributor base address */ > dist = (struct acpi_madt_generic_distributor *)header; > + if (BAD_MADT_ENTRY(dist, end)) > + return -EINVAL; > + Why does this need to be re-checked if the validation phased has succeeded? > acpi_data.dist_base = ioremap(dist->base_address, > ACPI_GICV3_DIST_MEM_SIZE); > if (!acpi_data.dist_base) { Thanks, M. -- Without deviation from the norm, progress is not possible.