[PATCH 0/6] irqchip: validate ACPI MADT entries before use

[PATCH 0/6] irqchip: validate ACPI MADT entries before use

[Jiale Yao]

IRQ chip ACPI probing receives MADT records supplied by firmware.  The
common probe path does not currently verify that the complete declared
entry is contained in the table, and several callbacks access
fixed-size records without checking their minimum size.  Malformed
entries can therefore cause out-of-bounds reads during early boot.

Add the common declared-range check first, then validate the concrete
ITS, GIC, LIO-PIC, and BIO-PIC records in their respective callbacks.
Each patch remains independently buildable and limits its changes to one
parser implementation.

Jiale Yao (6):
  ACPI: irqchip: validate MADT entry bounds before probing
  irqchip/gic-v3-its: validate MADT ITS entries
  irqchip/gic-v3: validate MADT records before use
  irqchip/gic-v5-its: validate MADT translate frames
  irqchip/loongarch-cpu: validate MADT LIO-PIC entries
  irqchip/loongson-eiointc: validate MADT BIO-PIC entries

 drivers/acpi/scan.c                    |  7 +++++++
 drivers/irqchip/irq-gic-v3-its.c       |  3 +++
 drivers/irqchip/irq-gic-v3.c           | 18 ++++++++++++++++++
 drivers/irqchip/irq-gic-v5-its.c       |  3 +++
 drivers/irqchip/irq-loongarch-cpu.c    |  3 +++
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 6 files changed, 42 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH 1/6] ACPI: irqchip: validate MADT entry bounds before probing

[Jiale Yao]

IRQ chip probing invokes validation and probe callbacks after the common
table walker has only established that a generic subtable header is
readable. A malformed length can leave callback field accesses outside
the MADT.

Validate the generic header length and ensure the complete declared
entry is contained in the table before invoking IRQ chip callbacks.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/scan.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 163a3cccf197..ef8e8441b6ef 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2889,6 +2889,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
 static int __init acpi_match_madt(union acpi_subtable_headers *header,
 				  const unsigned long end)
 {
+	unsigned long start = (unsigned long)header;
+
+	if (start >= end || end - start < sizeof(header->common) ||
+	    header->common.length < sizeof(header->common) ||
+	    header->common.length > end - start)
+		return -EINVAL;
+
 	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
 		if (!ape->probe_subtbl(header, end))
 			acpi_probe_count++;
-- 
2.34.1

[PATCH 2/6] irqchip/gic-v3-its: validate MADT ITS entries

[Jiale Yao]

The MADT ITS callback reads the translator base address and ID without
checking that firmware supplied a complete generic translator record. A
truncated entry can therefore cause out-of-bounds reads.

Reject incomplete ITS entries before accessing their typed fields.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e9807af23537..485a790e4856 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5725,6 +5725,9 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
 	int err;
 
 	its_entry = (struct acpi_madt_generic_translator *)header;
+	if (BAD_MADT_ENTRY(its_entry, end))
+		return -EINVAL;
+
 	memset(&res, 0, sizeof(res));
 	res.start = its_entry->base_address;
 	res.end = its_entry->base_address + ACPI_GICV3_ITS_MEM_SIZE - 1;
-- 
2.34.1

[PATCH 3/6] irqchip/gic-v3: validate MADT records before use

[Jiale Yao]

The GICv3 ACPI paths cast generic MADT headers to distributor,
redistributor, and CPU interface records before confirming that the
corresponding fixed-size structures are present. Truncated records can
therefore cause out-of-bounds field reads while probing or setting up
virtualization data.

Check each typed MADT record before its first field access. Also reject
a short distributor record in the version validator, which runs before
the probe callback.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6e1fa5b247fc..0588d6d83b31 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -2299,6 +2299,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header,
 			(struct acpi_madt_generic_redistributor *)header;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_ENTRY(redist, end))
+		return -EINVAL;
+
 	redist_base = ioremap(redist->base_address, redist->length);
 	if (!redist_base) {
 		pr_err("Couldn't map GICR region @%llx\n", redist->base_address);
@@ -2325,6 +2328,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header,
 	u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/* Neither enabled or online capable means it doesn't exist, skip it */
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
@@ -2391,6 +2397,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc =
 				(struct acpi_madt_generic_interrupt *)header;
 
+	if (BAD_MADT_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/*
 	 * If GICC is enabled and has valid gicr base address, then it means
 	 * GICR base is presented via GICC. The redistributor is only known to
@@ -2437,6 +2446,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
 	int count;
 
 	dist = (struct acpi_madt_generic_distributor *)header;
+	if (header->length < sizeof(*dist))
+		return false;
+
 	if (dist->version != ape->driver_data)
 		return false;
 
@@ -2457,6 +2469,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea
 	int maint_irq_mode;
 	static int first_madt = true;
 
+	if (BAD_MADT_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags &
 	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
@@ -2547,6 +2562,9 @@ gic_acpi_init(union acpi_subtable_headers *header, const unsigned long end)
 
 	/* Get distributor base address */
 	dist = (struct acpi_madt_generic_distributor *)header;
+	if (BAD_MADT_ENTRY(dist, end))
+		return -EINVAL;
+
 	acpi_data.dist_base = ioremap(dist->base_address,
 				      ACPI_GICV3_DIST_MEM_SIZE);
 	if (!acpi_data.dist_base) {
-- 
2.34.1

Re: [PATCH 3/6] irqchip/gic-v3: validate MADT records before use

[Marc Zyngier]

On Fri, 16 Oct 2026 15:13:54 +0100,
Jiale Yao <yaojiale02@163.com> wrote:
> 
> The GICv3 ACPI paths cast generic MADT headers to distributor,
> redistributor, and CPU interface records before confirming that the
> corresponding fixed-size structures are present. Truncated records can
> therefore cause out-of-bounds field reads while probing or setting up
> virtualization data.
>
> Check each typed MADT record before its first field access. Also reject
> a short distributor record in the version validator, which runs before
> the probe callback.
> 
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/irqchip/irq-gic-v3.c | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
> index 6e1fa5b247fc..0588d6d83b31 100644
> --- a/drivers/irqchip/irq-gic-v3.c
> +++ b/drivers/irqchip/irq-gic-v3.c
> @@ -2299,6 +2299,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header,
>  			(struct acpi_madt_generic_redistributor *)header;
>  	void __iomem *redist_base;
>  
> +	if (BAD_MADT_ENTRY(redist, end))
> +		return -EINVAL;
> +
>  	redist_base = ioremap(redist->base_address, redist->length);
>  	if (!redist_base) {
>  		pr_err("Couldn't map GICR region @%llx\n", redist->base_address);
> @@ -2325,6 +2328,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header,
>  	u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
>  	void __iomem *redist_base;
>  
> +	if (BAD_MADT_ENTRY(gicc, end))
> +		return -EINVAL;
> +
>  	/* Neither enabled or online capable means it doesn't exist, skip it */
>  	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
>  		return 0;
> @@ -2391,6 +2397,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
>  	struct acpi_madt_generic_interrupt *gicc =
>  				(struct acpi_madt_generic_interrupt *)header;
>  
> +	if (BAD_MADT_ENTRY(gicc, end))
> +		return -EINVAL;
> +
>  	/*
>  	 * If GICC is enabled and has valid gicr base address, then it means
>  	 * GICR base is presented via GICC. The redistributor is only known to
> @@ -2437,6 +2446,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
>  	int count;
>  
>  	dist = (struct acpi_madt_generic_distributor *)header;
> +	if (header->length < sizeof(*dist))
> +		return false;
> +

Why is this open-coded instead of using the checking macro?

>  	if (dist->version != ape->driver_data)
>  		return false;
>  
> @@ -2457,6 +2469,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea
>  	int maint_irq_mode;
>  	static int first_madt = true;
>  
> +	if (BAD_MADT_ENTRY(gicc, end))
> +		return -EINVAL;
> +

Why isn't this using BAD_MADT_GICC_ENTRY()?

>  	if (!(gicc->flags &
>  	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
>  		return 0;
> @@ -2547,6 +2562,9 @@ gic_acpi_init(union acpi_subtable_headers *header, const unsigned long end)
>  
>  	/* Get distributor base address */
>  	dist = (struct acpi_madt_generic_distributor *)header;
> +	if (BAD_MADT_ENTRY(dist, end))
> +		return -EINVAL;
> +

Why does this need to be re-checked if the validation phased has succeeded?

>  	acpi_data.dist_base = ioremap(dist->base_address,
>  				      ACPI_GICV3_DIST_MEM_SIZE);
>  	if (!acpi_data.dist_base) {

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.

Re:Re: [PATCH 3/6] irqchip/gic-v3: validate MADT records before use

[jiale yao]

Hi Marc,
At 2026-10-16 22:36:50, "Marc Zyngier" <maz@kernel.org> wrote:
>On Fri, 16 Oct 2026 15:13:54 +0100,
>Jiale Yao <yaojiale02@163.com> wrote:
>> 
>> The GICv3 ACPI paths cast generic MADT headers to distributor,
>> redistributor, and CPU interface records before confirming that the
>> corresponding fixed-size structures are present. Truncated records can
>> therefore cause out-of-bounds field reads while probing or setting up
>> virtualization data.
>>
>> Check each typed MADT record before its first field access. Also reject
>> a short distributor record in the version validator, which runs before
>> the probe callback.
>> 
>> Signed-off-by: Jiale Yao <yaojiale02@163.com>
>> ---
>>  drivers/irqchip/irq-gic-v3.c | 18 ++++++++++++++++++
>>  1 file changed, 18 insertions(+)
>> 
>> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
>> index 6e1fa5b247fc..0588d6d83b31 100644
>> --- a/drivers/irqchip/irq-gic-v3.c
>> +++ b/drivers/irqchip/irq-gic-v3.c
>> @@ -2299,6 +2299,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header,
>>  			(struct acpi_madt_generic_redistributor *)header;
>>  	void __iomem *redist_base;
>>  
>> +	if (BAD_MADT_ENTRY(redist, end))
>> +		return -EINVAL;
>> +
>>  	redist_base = ioremap(redist->base_address, redist->length);
>>  	if (!redist_base) {
>>  		pr_err("Couldn't map GICR region @%llx\n", redist->base_address);
>> @@ -2325,6 +2328,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header,
>>  	u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
>>  	void __iomem *redist_base;
>>  
>> +	if (BAD_MADT_ENTRY(gicc, end))
>> +		return -EINVAL;
>> +
>>  	/* Neither enabled or online capable means it doesn't exist, skip it */
>>  	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
>>  		return 0;
>> @@ -2391,6 +2397,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
>>  	struct acpi_madt_generic_interrupt *gicc =
>>  				(struct acpi_madt_generic_interrupt *)header;
>>  
>> +	if (BAD_MADT_ENTRY(gicc, end))
>> +		return -EINVAL;
>> +
>>  	/*
>>  	 * If GICC is enabled and has valid gicr base address, then it means
>>  	 * GICR base is presented via GICC. The redistributor is only known to
>> @@ -2437,6 +2446,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
>>  	int count;
>>  
>>  	dist = (struct acpi_madt_generic_distributor *)header;
>> +	if (header->length < sizeof(*dist))
>> +		return false;
>> +
>
>Why is this open-coded instead of using the checking macro?

Agreed. I will use BAD_MADT_ENTRY() with the end of the current record instead of open-coding the
minimum-size check.

>
>>  	if (dist->version != ape->driver_data)
>>  		return false;
>>  
>> @@ -2457,6 +2469,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea
>>  	int maint_irq_mode;
>>  	static int first_madt = true;
>>  
>> +	if (BAD_MADT_ENTRY(gicc, end))
>> +		return -EINVAL;
>> +
>
>Why isn't this using BAD_MADT_GICC_ENTRY()?

Good point. GICC records have a version-dependent size, and requiring sizeof(*gicc) can reject valid records
from older ACPI revisions. I will use BAD_MADT_GICC_ENTRY() here and in the other two GICC callbacks added by
this patch.

>
>>  	if (!(gicc->flags &
>>  	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
>>  		return 0;
>> @@ -2547,6 +2562,9 @@ gic_acpi_init(union acpi_subtable_headers *header, const unsigned long end)
>>  
>>  	/* Get distributor base address */
>>  	dist = (struct acpi_madt_generic_distributor *)header;
>> +	if (BAD_MADT_ENTRY(dist, end))
>> +		return -EINVAL;
>> +
>
>Why does this need to be re-checked if the validation phased has succeeded?

It does not. The probe callback is invoked with the same record immediately after acpi_validate_gic_table()
succeeds, so the check in gic_acpi_init() is redundant. I will remove it and keep the distributor-size
validation in the validation callback.

>
>>  	acpi_data.dist_base = ioremap(dist->base_address,
>>  				      ACPI_GICV3_DIST_MEM_SIZE);
>>  	if (!acpi_data.dist_base) {
>
>Thanks,
>
>	M.
>
>-- 
>Without deviation from the norm, progress is not possible.

I will fix them in v2, thanks for your review.

[PATCH 4/6] irqchip/gic-v5-its: validate MADT translate frames

[Jiale Yao]

The GICv5 ITS translate-frame callback accesses IDs and the base address
without checking that the MADT entry contains the complete fixed-size
record. A truncated firmware entry can therefore cause out-of-bounds
reads.

Reject incomplete translate-frame entries before using their fields.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 28e39b065de0..dad3b95ba150 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1233,6 +1233,9 @@ static int __init gic_acpi_parse_madt_its_translate(union acpi_subtable_headers
 	int err;
 
 	its_frame = (struct acpi_madt_gicv5_translate_frame *)header;
+	if (BAD_MADT_ENTRY(its_frame, end))
+		return -EINVAL;
+
 	if (its_frame->linked_translator_id != current_its_entry->translator_id)
 		return 0;
 
-- 
2.34.1

[PATCH 5/6] irqchip/loongarch-cpu: validate MADT LIO-PIC entries

[Jiale Yao]

The LIO-PIC MADT callback passes a typed record to the controller
initialization code without checking that the complete record is
present. A truncated firmware entry can therefore lead to out-of-bounds
field reads.

Reject incomplete LIO-PIC entries before passing them to the
initialization helper.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-cpu.c b/drivers/irqchip/irq-loongarch-cpu.c
index 84ce24889488..6185825477f4 100644
--- a/drivers/irqchip/irq-loongarch-cpu.c
+++ b/drivers/irqchip/irq-loongarch-cpu.c
@@ -119,6 +119,9 @@ static int __init liointc_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_lio_pic *liointc_entry = (struct acpi_madt_lio_pic *)header;
 
+	if (BAD_MADT_ENTRY(liointc_entry, end))
+		return -EINVAL;
+
 	return liointc_acpi_init(irq_domain, liointc_entry);
 }
 
-- 
2.34.1

[PATCH 6/6] irqchip/loongson-eiointc: validate MADT BIO-PIC entries

[Jiale Yao]

The BIO-PIC MADT callback reads the controller address before checking
that firmware supplied the complete fixed-size record. A truncated entry
can therefore cause an out-of-bounds read while selecting the parent
domain.

Validate the BIO-PIC record before accessing its address or passing it
to the initialization helper.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
index a9e8b481d31d..f92e7702195a 100644
--- a/drivers/irqchip/irq-loongson-eiointc.c
+++ b/drivers/irqchip/irq-loongson-eiointc.c
@@ -454,8 +454,14 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
 					const unsigned long end)
 {
 	struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
-	unsigned int node = (pchpic_entry->address >> 44) & 0xf;
-	struct irq_domain *parent = acpi_get_vec_parent(node, pch_group);
+	struct irq_domain *parent;
+	unsigned int node;
+
+	if (BAD_MADT_ENTRY(pchpic_entry, end))
+		return -EINVAL;
+
+	node = (pchpic_entry->address >> 44) & 0xf;
+	parent = acpi_get_vec_parent(node, pch_group);
 
 	if (parent)
 		return pch_pic_acpi_init(parent, pchpic_entry);
-- 
2.34.1