From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E3E4606A31A for ; Wed, 28 Oct 2026 08:23:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=3qUlE2dw; dkim=fail reason="signature verification failed" (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ZL8jr8Y7 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Unsubscribe-Post:List-Owner; bh=e75bhDDrmdB0xq+aCmIiZzj0qF34ax9AEXaTVAuBmrY=; b=3qUlE2dwbRzJN7iBlzyPbE5It4 fEIvoSH/ZdwFJDJQ+OvlYAODK+lHdZT8R8R5lRh+/lNoEixWFYXZkC+6C4Bi0UdTFyq8a16rKL0iV k7uFHHCrAt/rBH8RsE0ZE79FnDVyppZ+tl/f4NJ/ZBmsTpbRC3cw3exhpc5O+YUPxBNVXZ8yYEtTc cE3903ArUMNqS6wYctk985nBZi6XHru0G4bNnOk663lTFBWxoCgP0+28WUsfVYBUnW7+t4yr0mkjp w6Z6TY4rkkDFm92TdTLn0h3qAWn2YL0ElkhrOnFlIS2AGkbpxHa+miXIk6LuQ2h0DjzPpadMTQFQB xb1X/WvQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLywO-00000006Xq9-0kjf; Wed, 28 Oct 2026 08:23:24 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLywM-00000006Xps-40ln; Wed, 28 Oct 2026 08:23:23 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 40D0442ADB; Wed, 28 Oct 2026 08:23:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1DE3C1F01825; Wed, 28 Oct 2026 08:23:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793175802; bh=oi76zVLqRGBKbEzlYKScXk0Y5BaGKUVtwQusrfnUs5M=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=ZL8jr8Y7iXVGk1a6orLHdtmPCjF718grxXoQZnVPL4GvQRdRl05DjNjcgF+CdvYr1 rOFtqbscS6ehiqR8YjtxvacCNlv1Fd7ZP2K5DM6BJO2lVbt0/ICRjzOy+7A3clbSQT 3m8CtOkBOAECobb43W+OWcTgS4cyGB44pdS/SV1nsLqpmBCtdd4VWmrBbhMOAtKxPi gczbZb+ZGR+GQqnY11QrHZFtSknxqD4wGYSVgwjticezk5plamMGCfxacwqeo11NVf 2ArufGw3NQMjAsVtIIB8HRMgM8ngJEbOmWjR3PSOxOD+m84PX4b/0rrHy1K3UeURcK 31f2KlN3Sypcw== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xLywJ-000000081ye-2Bov; Wed, 28 Oct 2026 08:23:19 +0000 Date: Wed, 28 Oct 2026 08:23:18 +0000 Message-ID: <86qzhaxmh5.wl-maz@kernel.org> From: Marc Zyngier To: Jiale Yao Subject: Re: [PATCH 00/12] irqchip: validate remaining MADT records before use In-Reply-To: <20261028050039.121080-1-yaojiale02@163.com> References: <20261028050039.121080-1-yaojiale02@163.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) X-Archived-By: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: yaojiale02@163.com, pjw@kernel.org, palmer@dabbelt.com, aou@eecs.berkeley.edu, alex@ghiti.fr, lpieralisi@kernel.org, tglx@kernel.org, radu@rendec.net, chenhuacai@kernel.org, kernel@xen0n.name, jiaxun.yang@flygoat.com, anup@brainfault.org, rafael.j.wysocki@intel.com, sunilvl@ventanamicro.com, andrew.jones@linux.dev, jic23@kernel.org, guohanjun@huawei.com, tomasz.nowicki@linaro.org, grant.likely@linaro.org, jason@lakedaemon.net, rrichter@cavium.com, catalin.marinas@arm.com, wangliupu@loongson.cn, zhangtianyang@loongson.cn, lvjianmin@loongson.cn, conor.dooley@microchip.com, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev, linux-mips@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Rafael J. Wysocki" , Tianyang Zhang , Catalin Marinas , Lorenzo Pieralisi , Jiaxun Yang , Andrew Jones , Conor Dooley , Hanjun Guo , WANG Xuerui , linux-riscv@lists.infradead.org, Alexandre Ghiti , Anup Patel , Huacai Chen , Liupu Wang , Grant Likely , linux-mips@vger.kernel.org, Albert Ou , Jason Cooper , Tomasz Nowicki , Robert Richter , Jianmin Lv , loongarch@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Radu Rendec , Palmer Dabbelt , Thomas Gleixner , Paul Walmsley , Jonathan Cameron Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" X-Spam-Status: No, score=-3.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 On Wed, 28 Oct 2026 05:00:27 +0000, Jiale Yao wrote: > > Several ACPI interrupt-controller callbacks cast generic MADT subtable > headers to controller-specific records and access typed fields without > first checking that the firmware supplied the complete structure. A > truncated entry can therefore cause an out-of-bounds read during early > interrupt-controller and CPU discovery. > > Add the missing minimum-size checks at the callback boundaries. Records > which are passed from a probe validator to an initialization callback are > validated once in the validator, before either callback accesses them. > > The issues were found by code inspection and have not been tested on real > hardware. How does this compare to the series posted at [1]? No version number, no change log, and not even an attempt at a QEMU test run. If you want people to review this stuff, you need to up your game a tiny bit. M. [1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com -- Without deviation from the norm, progress is not possible. _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2A6A606A31A for ; Wed, 28 Oct 2026 08:23:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=K/d8P9HG; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ZL8jr8Y7 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: References:In-Reply-To:Subject:Cc:To:From:Message-ID:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Unsubscribe-Post:List-Owner; bh=oi76zVLqRGBKbEzlYKScXk0Y5BaGKUVtwQusrfnUs5M=; b=K/d8P9HG259V4gCDRsjOcexC2m +a1AfLRU7qTXwTKFUpuk/OjBcEDurCdrqctJR1bh3MPAK8nMMSdpHmcUuRSirA3RIP4gwV/5BlKkg tXJ+Q4Ia9WghRtw4VYvxg+216ONVHpW8sepH+nDieXgw3Dhc2iiEKP1fwblfGp1qW85uiCD0t0Qph aZ2YXs6nAghKv9dNRZKnr6Mm4aPQkUUSU0HC7/qDykIqOErwYej1XRCxqk9/SdF7IVq9t4sl7Nit0 C63k2iMz4f8UunUNhMeDJVOpbLct28Xyx9HYVJGlKuTEiZLVROr+xnBbdBBm4aBt8UoaFELRhcTQ0 1MdIGdPA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLywO-00000006Xq1-0KtT; Wed, 28 Oct 2026 08:23:24 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLywM-00000006Xps-40ln; Wed, 28 Oct 2026 08:23:23 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 40D0442ADB; Wed, 28 Oct 2026 08:23:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1DE3C1F01825; Wed, 28 Oct 2026 08:23:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793175802; bh=oi76zVLqRGBKbEzlYKScXk0Y5BaGKUVtwQusrfnUs5M=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=ZL8jr8Y7iXVGk1a6orLHdtmPCjF718grxXoQZnVPL4GvQRdRl05DjNjcgF+CdvYr1 rOFtqbscS6ehiqR8YjtxvacCNlv1Fd7ZP2K5DM6BJO2lVbt0/ICRjzOy+7A3clbSQT 3m8CtOkBOAECobb43W+OWcTgS4cyGB44pdS/SV1nsLqpmBCtdd4VWmrBbhMOAtKxPi gczbZb+ZGR+GQqnY11QrHZFtSknxqD4wGYSVgwjticezk5plamMGCfxacwqeo11NVf 2ArufGw3NQMjAsVtIIB8HRMgM8ngJEbOmWjR3PSOxOD+m84PX4b/0rrHy1K3UeURcK 31f2KlN3Sypcw== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xLywJ-000000081ye-2Bov; Wed, 28 Oct 2026 08:23:19 +0000 Date: Wed, 28 Oct 2026 08:23:18 +0000 Message-ID: <86qzhaxmh5.wl-maz@kernel.org> From: Marc Zyngier To: Jiale Yao Cc: Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Lorenzo Pieralisi , Thomas Gleixner , Radu Rendec , Huacai Chen , WANG Xuerui , Jiaxun Yang , Anup Patel , "Rafael J. Wysocki" , Sunil V L , Andrew Jones , Jonathan Cameron , Hanjun Guo , Tomasz Nowicki , Grant Likely , Jason Cooper , Robert Richter , Catalin Marinas , Liupu Wang , Tianyang Zhang , Jianmin Lv , Conor Dooley , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev, linux-mips@vger.kernel.org Subject: Re: [PATCH 00/12] irqchip: validate remaining MADT records before use In-Reply-To: <20261028050039.121080-1-yaojiale02@163.com> References: <20261028050039.121080-1-yaojiale02@163.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) X-Archived-By: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: yaojiale02@163.com, pjw@kernel.org, palmer@dabbelt.com, aou@eecs.berkeley.edu, alex@ghiti.fr, lpieralisi@kernel.org, tglx@kernel.org, radu@rendec.net, chenhuacai@kernel.org, kernel@xen0n.name, jiaxun.yang@flygoat.com, anup@brainfault.org, rafael.j.wysocki@intel.com, sunilvl@ventanamicro.com, andrew.jones@linux.dev, jic23@kernel.org, guohanjun@huawei.com, tomasz.nowicki@linaro.org, grant.likely@linaro.org, jason@lakedaemon.net, rrichter@cavium.com, catalin.marinas@arm.com, wangliupu@loongson.cn, zhangtianyang@loongson.cn, lvjianmin@loongson.cn, conor.dooley@microchip.com, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev, linux-mips@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" X-Spam-Status: No, score=-5.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 On Wed, 28 Oct 2026 05:00:27 +0000, Jiale Yao wrote: > > Several ACPI interrupt-controller callbacks cast generic MADT subtable > headers to controller-specific records and access typed fields without > first checking that the firmware supplied the complete structure. A > truncated entry can therefore cause an out-of-bounds read during early > interrupt-controller and CPU discovery. > > Add the missing minimum-size checks at the callback boundaries. Records > which are passed from a probe validator to an initialization callback are > validated once in the validator, before either callback accesses them. > > The issues were found by code inspection and have not been tested on real > hardware. How does this compare to the series posted at [1]? No version number, no change log, and not even an attempt at a QEMU test run. If you want people to review this stuff, you need to up your game a tiny bit. M. [1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com -- Without deviation from the norm, progress is not possible.