From: Marc Zyngier <maz@kernel.org>
To: Jiale Yao <yaojiale02@163.com>
Cc: Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexandre Ghiti <alex@ghiti.fr>,
Lorenzo Pieralisi <lpieralisi@kernel.org>,
Thomas Gleixner <tglx@kernel.org>, Radu Rendec <radu@rendec.net>,
Huacai Chen <chenhuacai@kernel.org>,
WANG Xuerui <kernel@xen0n.name>,
Jiaxun Yang <jiaxun.yang@flygoat.com>,
Anup Patel <anup@brainfault.org>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
Sunil V L <sunilvl@ventanamicro.com>,
Andrew Jones <andrew.jones@linux.dev>,
Jonathan Cameron <jic23@kernel.org>,
Hanjun Guo <guohanjun@huawei.com>,
Tomasz Nowicki <tomasz.nowicki@linaro.org>,
Grant Likely <grant.likely@linaro.org>,
Jason Cooper <jason@lakedaemon.net>,
Robert Richter <rrichter@cavium.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Liupu Wang <wangliupu@loongson.cn>,
Tianyang Zhang <zhangtianyang@loongson.cn>,
Jianmin Lv <lvjianmin@loongson.cn>,
Conor Dooley <conor.dooley@microchip.com>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev,
linux-mips@vger.kernel.org
Subject: Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
Date: Wed, 28 Oct 2026 08:23:18 +0000 [thread overview]
Message-ID: <86qzhaxmh5.wl-maz@kernel.org> (raw)
In-Reply-To: <20261028050039.121080-1-yaojiale02@163.com>
On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
>
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
>
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
>
> The issues were found by code inspection and have not been tested on real
> hardware.
How does this compare to the series posted at [1]?
No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.
M.
[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
--
Without deviation from the norm, progress is not possible.
WARNING: multiple messages have this Message-ID (diff)
From: Marc Zyngier <maz@kernel.org>
To: Jiale Yao <yaojiale02@163.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
Tianyang Zhang <zhangtianyang@loongson.cn>,
Catalin Marinas <catalin.marinas@arm.com>,
Lorenzo Pieralisi <lpieralisi@kernel.org>,
Jiaxun Yang <jiaxun.yang@flygoat.com>,
Andrew Jones <andrew.jones@linux.dev>,
Conor Dooley <conor.dooley@microchip.com>,
Hanjun Guo <guohanjun@huawei.com>,
WANG Xuerui <kernel@xen0n.name>,
linux-riscv@lists.infradead.org, Alexandre Ghiti <alex@ghiti.fr>,
Anup Patel <anup@brainfault.org>,
Huacai Chen <chenhuacai@kernel.org>,
Liupu Wang <wangliupu@loongson.cn>,
Grant Likely <grant.likely@linaro.org>,
linux-mips@vger.kernel.org, Albert Ou <aou@eecs.berkeley.edu>,
Jason Cooper <jason@lakedaemon.net>,
Tomasz Nowicki <tomasz.nowicki@linaro.org>,
Robert Richter <rrichter@cavium.com>,
Jianmin Lv <lvjianmin@loongson.cn>,
loongarch@lists.linux.dev, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, Radu Rendec <radu@rendec.net>,
Palmer Dabbelt <palmer@dabbelt.com>,
Thomas Gleixner <tglx@kernel.org>, Paul Walmsley <pjw@kernel.org>,
Jonathan Cameron <jic23@kernel.org>
Subject: Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
Date: Wed, 28 Oct 2026 08:23:18 +0000 [thread overview]
Message-ID: <86qzhaxmh5.wl-maz@kernel.org> (raw)
In-Reply-To: <20261028050039.121080-1-yaojiale02@163.com>
On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
>
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
>
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
>
> The issues were found by code inspection and have not been tested on real
> hardware.
How does this compare to the series posted at [1]?
No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.
M.
[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
--
Without deviation from the norm, progress is not possible.
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
next prev parent reply other threads:[~2026-10-28 8:23 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 01/12] riscv: acpi: validate RINTC entries " Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries Jiale Yao
2026-10-28 5:00 ` [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records Jiale Yao
2026-10-28 5:00 ` [PATCH 05/12] irqchip/gic: validate MADT distributor records Jiale Yao
2026-10-28 5:00 ` [PATCH 06/12] irqchip/loongarch-avec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 07/12] irqchip/loongarch-ir: " Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries Jiale Yao
2026-10-28 8:23 ` Marc Zyngier [this message]
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
2026-10-29 4:01 ` jiale yao
2026-10-29 4:01 ` jiale yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=86qzhaxmh5.wl-maz@kernel.org \
--to=maz@kernel.org \
--cc=alex@ghiti.fr \
--cc=andrew.jones@linux.dev \
--cc=anup@brainfault.org \
--cc=aou@eecs.berkeley.edu \
--cc=catalin.marinas@arm.com \
--cc=chenhuacai@kernel.org \
--cc=conor.dooley@microchip.com \
--cc=grant.likely@linaro.org \
--cc=guohanjun@huawei.com \
--cc=jason@lakedaemon.net \
--cc=jiaxun.yang@flygoat.com \
--cc=jic23@kernel.org \
--cc=kernel@xen0n.name \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=loongarch@lists.linux.dev \
--cc=lpieralisi@kernel.org \
--cc=lvjianmin@loongson.cn \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
--cc=radu@rendec.net \
--cc=rafael.j.wysocki@intel.com \
--cc=rrichter@cavium.com \
--cc=sunilvl@ventanamicro.com \
--cc=tglx@kernel.org \
--cc=tomasz.nowicki@linaro.org \
--cc=wangliupu@loongson.cn \
--cc=yaojiale02@163.com \
--cc=zhangtianyang@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.