[PATCH 00/12] irqchip: validate remaining MADT records before use

[PATCH 00/12] irqchip: validate remaining MADT records before use

[Jiale Yao]

Several ACPI interrupt-controller callbacks cast generic MADT subtable
headers to controller-specific records and access typed fields without
first checking that the firmware supplied the complete structure. A
truncated entry can therefore cause an out-of-bounds read during early
interrupt-controller and CPU discovery.

Add the missing minimum-size checks at the callback boundaries. Records
which are passed from a probe validator to an initialization callback are
validated once in the validator, before either callback accesses them.

The issues were found by code inspection and have not been tested on real
hardware.

Jiale Yao (12):
  riscv: acpi: validate RINTC entries before use
  irqchip/gic-v5-irs: validate MADT GICC entries
  irqchip/gic-v5-irs: validate MADT IRS entries
  irqchip/gic-v5: validate MADT IRS records
  irqchip/gic: validate MADT distributor records
  irqchip/loongarch-avec: validate MADT MSI-PIC entries
  irqchip/loongarch-ir: validate MADT MSI-PIC entries
  irqchip/loongson-htvec: validate MADT BIO-PIC entries
  irqchip/loongson-htvec: validate MADT MSI-PIC entries
  irqchip/loongson-liointc: validate MADT HT-PIC entries
  irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
  irqchip/riscv-intc: validate MADT RINTC entries

 arch/riscv/kernel/acpi.c               | 3 +++
 drivers/irqchip/irq-gic-v5-irs.c       | 6 ++++++
 drivers/irqchip/irq-gic-v5.c           | 3 +++
 drivers/irqchip/irq-gic.c              | 3 +++
 drivers/irqchip/irq-loongarch-avec.c   | 3 +++
 drivers/irqchip/irq-loongarch-ir.c     | 3 +++
 drivers/irqchip/irq-loongson-htvec.c   | 6 ++++++
 drivers/irqchip/irq-loongson-liointc.c | 3 +++
 drivers/irqchip/irq-loongson-pch-pic.c | 3 +++
 drivers/irqchip/irq-riscv-intc.c       | 5 ++++-
 10 files changed, 37 insertions(+), 1 deletion(-)

-- 
2.34.1

[PATCH 00/12] irqchip: validate remaining MADT records before use

[Jiale Yao]

Several ACPI interrupt-controller callbacks cast generic MADT subtable
headers to controller-specific records and access typed fields without
first checking that the firmware supplied the complete structure. A
truncated entry can therefore cause an out-of-bounds read during early
interrupt-controller and CPU discovery.

Add the missing minimum-size checks at the callback boundaries. Records
which are passed from a probe validator to an initialization callback are
validated once in the validator, before either callback accesses them.

The issues were found by code inspection and have not been tested on real
hardware.

Jiale Yao (12):
  riscv: acpi: validate RINTC entries before use
  irqchip/gic-v5-irs: validate MADT GICC entries
  irqchip/gic-v5-irs: validate MADT IRS entries
  irqchip/gic-v5: validate MADT IRS records
  irqchip/gic: validate MADT distributor records
  irqchip/loongarch-avec: validate MADT MSI-PIC entries
  irqchip/loongarch-ir: validate MADT MSI-PIC entries
  irqchip/loongson-htvec: validate MADT BIO-PIC entries
  irqchip/loongson-htvec: validate MADT MSI-PIC entries
  irqchip/loongson-liointc: validate MADT HT-PIC entries
  irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
  irqchip/riscv-intc: validate MADT RINTC entries

 arch/riscv/kernel/acpi.c               | 3 +++
 drivers/irqchip/irq-gic-v5-irs.c       | 6 ++++++
 drivers/irqchip/irq-gic-v5.c           | 3 +++
 drivers/irqchip/irq-gic.c              | 3 +++
 drivers/irqchip/irq-loongarch-avec.c   | 3 +++
 drivers/irqchip/irq-loongarch-ir.c     | 3 +++
 drivers/irqchip/irq-loongson-htvec.c   | 6 ++++++
 drivers/irqchip/irq-loongson-liointc.c | 3 +++
 drivers/irqchip/irq-loongson-pch-pic.c | 3 +++
 drivers/irqchip/irq-riscv-intc.c       | 5 ++++-
 10 files changed, 37 insertions(+), 1 deletion(-)

-- 
2.34.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH 01/12] riscv: acpi: validate RINTC entries before use

[Jiale Yao]

The RINTC callback reads flags and other fields from a typed MADT record
without checking that the complete record is present. A truncated
firmware entry can therefore cause out-of-bounds reads during CPU map
initialization.

Reject incomplete RINTC entries before accessing typed fields.

Fixes: f99561199470 ("RISC-V: ACPI: Cache and retrieve the RINTC structure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/acpi.c b/arch/riscv/kernel/acpi.c
index efd52a5d05b5..9e0658c6a869 100644
--- a/arch/riscv/kernel/acpi.c
+++ b/arch/riscv/kernel/acpi.c
@@ -171,6 +171,9 @@ static int acpi_parse_madt_rintc(union acpi_subtable_headers *header, const unsi
 	struct acpi_madt_rintc *rintc = (struct acpi_madt_rintc *)header;
 	int cpuid;
 
+	if (BAD_MADT_ENTRY(rintc, end))
+		return -EINVAL;
+
 	if (!(rintc->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-- 
2.34.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries

[Jiale Yao]

The IAFFID parser reads fields from a typed GICC record without checking
that the MADT entry contains the fields it accesses. Reject truncated
entries before reading them.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-irs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 9d60f474aa4f..4e60a1caaba5 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -891,6 +891,9 @@ static int __init gic_acpi_parse_iaffid(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc = (struct acpi_madt_generic_interrupt *)header;
 	int cpu;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
 
-- 
2.34.1

[PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries

[Jiale Yao]

The IRS parser uses configuration addresses and flags from a typed MADT
record without checking its size. Reject incomplete IRS records before
accessing those fields.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-irs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 4e60a1caaba5..0139f80934d7 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -955,6 +955,9 @@ static int __init gic_acpi_parse_madt_irs(union acpi_subtable_headers *header,
 	struct resource *r;
 	int ret;
 
+	if (BAD_MADT_ENTRY(irs, end))
+		return -EINVAL;
+
 	/* Per-IRS data structure */
 	irs_data = kzalloc_obj(*irs_data);
 	if (!irs_data)
-- 
2.34.1

[PATCH 04/12] irqchip/gic-v5: validate MADT IRS records

[Jiale Yao]

The ACPI probe validator reads the version from a typed IRS record
without first establishing its minimum size. The accepted record is
later used by the initialization callback for further typed field
accesses.

Reject incomplete IRS records in the validator before either callback
can use them.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
index 8c0303af71e7..8451b780b0ea 100644
--- a/drivers/irqchip/irq-gic-v5.c
+++ b/drivers/irqchip/irq-gic-v5.c
@@ -1309,6 +1309,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
 {
 	struct acpi_madt_gicv5_irs *irs = (struct acpi_madt_gicv5_irs *)header;
 
+	if (BAD_MADT_ENTRY(irs, (unsigned long)header + header->length))
+		return false;
+
 	return (irs->version == ape->driver_data);
 }
 
-- 
2.34.1

[PATCH 05/12] irqchip/gic: validate MADT distributor records

[Jiale Yao]

The ACPI probe validator reads the version from a typed distributor
record without first establishing its size. The accepted record is then
passed to the initialization callback, which reads its base address.

Reject incomplete distributor records in the validator before either
callback accesses typed fields.

Fixes: d60fc3892c4de ("irqchip: Add GICv2 specific ACPI boot support")
Fixes: f26527b1428f ("irqchip / GIC: Convert the GIC driver to ACPI probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index a5ca04e9be64..21fcbfdc2093 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1583,6 +1583,9 @@ static bool __init gic_validate_dist(struct acpi_subtable_header *header,
 	struct acpi_madt_generic_distributor *dist;
 	dist = (struct acpi_madt_generic_distributor *)header;
 
+	if (BAD_MADT_ENTRY(dist, (unsigned long)header + header->length))
+		return false;
+
 	return (dist->version == ape->driver_data &&
 		(dist->version != ACPI_MADT_GIC_VERSION_NONE ||
 		 !acpi_gic_redist_is_present()));
-- 
2.34.1

[PATCH 06/12] irqchip/loongarch-avec: validate MADT MSI-PIC entries

[Jiale Yao]

The MSI-PIC callback reads the message address from a typed MADT record
without checking its size. Reject incomplete records before accessing
the field.

Fixes: ae16f05c928a ("irqchip/loongarch-avec: Add AVEC irqchip support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-avec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-avec.c b/drivers/irqchip/irq-loongarch-avec.c
index 53d7d23af9bb..ae12541dd167 100644
--- a/drivers/irqchip/irq-loongarch-avec.c
+++ b/drivers/irqchip/irq-loongarch-avec.c
@@ -399,6 +399,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchmsi_entry, end))
+		return -EINVAL;
+
 	loongarch_avec.msi_base_addr = pchmsi_entry->msg_address - AVEC_MSG_OFFSET;
 
 	return pch_msi_acpi_init_avec(loongarch_avec.domain);
-- 
2.34.1

[PATCH 07/12] irqchip/loongarch-ir: validate MADT MSI-PIC entries

[Jiale Yao]

The MSI-PIC callback reads the message address from a typed MADT record
without checking its size. Reject incomplete records before accessing
the field.

Fixes: 71619266e0a2 ("irqchip/loongarch-ir: Add IR (interrupt redirection) irqchip support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-ir.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-ir.c b/drivers/irqchip/irq-loongarch-ir.c
index cb4ad34da058..111173fc4612 100644
--- a/drivers/irqchip/irq-loongarch-ir.c
+++ b/drivers/irqchip/irq-loongarch-ir.c
@@ -481,6 +481,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header, const
 {
 	struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchmsi_entry, end))
+		return -EINVAL;
+
 	msi_base_addr = pchmsi_entry->msg_address - AVEC_MSG_OFFSET;
 
 	return pch_msi_acpi_init_avec(redirect_domain);
-- 
2.34.1

[PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries

[Jiale Yao]

The HT-vector cascade callback passes a typed BIO-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.

Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-htvec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
index 75e40ba6069d..725f30b7574b 100644
--- a/drivers/irqchip/irq-loongson-htvec.c
+++ b/drivers/irqchip/irq-loongson-htvec.c
@@ -269,6 +269,9 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchpic_entry, end))
+		return -EINVAL;
+
 	return pch_pic_acpi_init(htvec_priv->htvec_domain, pchpic_entry);
 }
 
-- 
2.34.1

[PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries

[Jiale Yao]

The HT-vector cascade callback passes a typed MSI-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.

Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-htvec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
index 725f30b7574b..1f5bf01c3183 100644
--- a/drivers/irqchip/irq-loongson-htvec.c
+++ b/drivers/irqchip/irq-loongson-htvec.c
@@ -280,6 +280,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchmsi_entry, end))
+		return -EINVAL;
+
 	return pch_msi_acpi_init(htvec_priv->htvec_domain, pchmsi_entry);
 }
 
-- 
2.34.1

[PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries

[Jiale Yao]

The LIOINTC cascade callback passes a typed HT-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.

Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-liointc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongson-liointc.c b/drivers/irqchip/irq-loongson-liointc.c
index cf44a333b9c8..2b6fdf9eff42 100644
--- a/drivers/irqchip/irq-loongson-liointc.c
+++ b/drivers/irqchip/irq-loongson-liointc.c
@@ -378,6 +378,9 @@ static int __init htintc_parse_madt(union acpi_subtable_headers *header,
 	struct acpi_madt_ht_pic *htintc_entry = (struct acpi_madt_ht_pic *)header;
 	struct irq_domain *parent = irq_find_matching_fwnode(liointc_handle, DOMAIN_BUS_ANY);
 
+	if (BAD_MADT_ENTRY(htintc_entry, end))
+		return -EINVAL;
+
 	return htvec_acpi_init(parent, htintc_entry);
 }
 
-- 
2.34.1

Re: [PATCH 00/12] irqchip: validate remaining MADT records before use

[Marc Zyngier]

On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
> 
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
> 
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
> 
> The issues were found by code inspection and have not been tested on real
> hardware.

How does this compare to the series posted at [1]?

No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.

	M.

[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com

-- 
Without deviation from the norm, progress is not possible.

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH 00/12] irqchip: validate remaining MADT records before use

[Marc Zyngier]

On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
> 
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
> 
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
> 
> The issues were found by code inspection and have not been tested on real
> hardware.

How does this compare to the series posted at [1]?

No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.

	M.

[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com

-- 
Without deviation from the norm, progress is not possible.

Re:Re: [PATCH 00/12] irqchip: validate remaining MADT records before use

[jiale yao]

At 2026-10-28 16:23:18, "Marc Zyngier" <maz@kernel.org> wrote:
>On Wed, 28 Oct 2026 05:00:27 +0000,
>Jiale Yao <yaojiale02@163.com> wrote:
>> 
>> Several ACPI interrupt-controller callbacks cast generic MADT subtable
>> headers to controller-specific records and access typed fields without
>> first checking that the firmware supplied the complete structure. A
>> truncated entry can therefore cause an out-of-bounds read during early
>> interrupt-controller and CPU discovery.
>> 
>> Add the missing minimum-size checks at the callback boundaries. Records
>> which are passed from a probe validator to an initialization callback are
>> validated once in the validator, before either callback accesses them.
>> 
>> The issues were found by code inspection and have not been tested on real
>> hardware.
>
>How does this compare to the series posted at [1]?
>
>No version number, no change log, and not even an attempt at a QEMU
>test run. If you want people to review this stuff, you need to up your
>game a tiny bit.
>
>	M.
>
>[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com

Thanks for your review, I have added test information, with a new series.

https://lore.kernel.org/lkml/20261029035253.2333852-1-yaojiale02@163.com/


>
>-- 
>Without deviation from the norm, progress is not possible.

Re:Re: [PATCH 00/12] irqchip: validate remaining MADT records before use

[jiale yao]

At 2026-10-28 16:23:18, "Marc Zyngier" <maz@kernel.org> wrote:
>On Wed, 28 Oct 2026 05:00:27 +0000,
>Jiale Yao <yaojiale02@163.com> wrote:
>> 
>> Several ACPI interrupt-controller callbacks cast generic MADT subtable
>> headers to controller-specific records and access typed fields without
>> first checking that the firmware supplied the complete structure. A
>> truncated entry can therefore cause an out-of-bounds read during early
>> interrupt-controller and CPU discovery.
>> 
>> Add the missing minimum-size checks at the callback boundaries. Records
>> which are passed from a probe validator to an initialization callback are
>> validated once in the validator, before either callback accesses them.
>> 
>> The issues were found by code inspection and have not been tested on real
>> hardware.
>
>How does this compare to the series posted at [1]?
>
>No version number, no change log, and not even an attempt at a QEMU
>test run. If you want people to review this stuff, you need to up your
>game a tiny bit.
>
>	M.
>
>[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com

Thanks for your review, I have added test information, with a new series.

https://lore.kernel.org/lkml/20261029035253.2333852-1-yaojiale02@163.com/


>
>-- 
>Without deviation from the norm, progress is not possible.
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv