* [PATCH 00/12] irqchip: validate remaining MADT records before use
@ 2026-10-28 5:00 Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Marc Zyngier, Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec,
Huacai Chen, WANG Xuerui, Jiaxun Yang, Anup Patel,
Rafael J. Wysocki, Sunil V L, Andrew Jones, Jonathan Cameron,
Hanjun Guo, Tomasz Nowicki, Grant Likely, Jason Cooper,
Robert Richter, Catalin Marinas, Liupu Wang, Tianyang Zhang,
Jianmin Lv, Conor Dooley, linux-riscv, linux-kernel,
linux-arm-kernel, loongarch, linux-mips
Several ACPI interrupt-controller callbacks cast generic MADT subtable
headers to controller-specific records and access typed fields without
first checking that the firmware supplied the complete structure. A
truncated entry can therefore cause an out-of-bounds read during early
interrupt-controller and CPU discovery.
Add the missing minimum-size checks at the callback boundaries. Records
which are passed from a probe validator to an initialization callback are
validated once in the validator, before either callback accesses them.
The issues were found by code inspection and have not been tested on real
hardware.
Jiale Yao (12):
riscv: acpi: validate RINTC entries before use
irqchip/gic-v5-irs: validate MADT GICC entries
irqchip/gic-v5-irs: validate MADT IRS entries
irqchip/gic-v5: validate MADT IRS records
irqchip/gic: validate MADT distributor records
irqchip/loongarch-avec: validate MADT MSI-PIC entries
irqchip/loongarch-ir: validate MADT MSI-PIC entries
irqchip/loongson-htvec: validate MADT BIO-PIC entries
irqchip/loongson-htvec: validate MADT MSI-PIC entries
irqchip/loongson-liointc: validate MADT HT-PIC entries
irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
irqchip/riscv-intc: validate MADT RINTC entries
arch/riscv/kernel/acpi.c | 3 +++
drivers/irqchip/irq-gic-v5-irs.c | 6 ++++++
drivers/irqchip/irq-gic-v5.c | 3 +++
drivers/irqchip/irq-gic.c | 3 +++
drivers/irqchip/irq-loongarch-avec.c | 3 +++
drivers/irqchip/irq-loongarch-ir.c | 3 +++
drivers/irqchip/irq-loongson-htvec.c | 6 ++++++
drivers/irqchip/irq-loongson-liointc.c | 3 +++
drivers/irqchip/irq-loongson-pch-pic.c | 3 +++
drivers/irqchip/irq-riscv-intc.c | 5 ++++-
10 files changed, 37 insertions(+), 1 deletion(-)
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries Jiale Yao
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Lorenzo Pieralisi, Marc Zyngier, Thomas Gleixner, Radu Rendec,
Jonathan Cameron, Rafael J. Wysocki, linux-arm-kernel,
linux-kernel
Cc: stable
The IAFFID parser reads fields from a typed GICC record without checking
that the MADT entry contains the fields it accesses. Reject truncated
entries before reading them.
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-gic-v5-irs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 9d60f474aa4f..4e60a1caaba5 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -891,6 +891,9 @@ static int __init gic_acpi_parse_iaffid(union acpi_subtable_headers *header,
struct acpi_madt_generic_interrupt *gicc = (struct acpi_madt_generic_interrupt *)header;
int cpu;
+ if (BAD_MADT_GICC_ENTRY(gicc, end))
+ return -EINVAL;
+
if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records Jiale Yao
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Marc Zyngier, Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec,
Jonathan Cameron, Rafael J. Wysocki, linux-arm-kernel,
linux-kernel
Cc: stable
The IRS parser uses configuration addresses and flags from a typed MADT
record without checking its size. Reject incomplete IRS records before
accessing those fields.
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-gic-v5-irs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 4e60a1caaba5..0139f80934d7 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -955,6 +955,9 @@ static int __init gic_acpi_parse_madt_irs(union acpi_subtable_headers *header,
struct resource *r;
int ret;
+ if (BAD_MADT_ENTRY(irs, end))
+ return -EINVAL;
+
/* Per-IRS data structure */
irs_data = kzalloc_obj(*irs_data);
if (!irs_data)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 05/12] irqchip/gic: validate MADT distributor records Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
4 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Marc Zyngier, Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec,
Jonathan Cameron, Rafael J. Wysocki, linux-arm-kernel,
linux-kernel
Cc: stable
The ACPI probe validator reads the version from a typed IRS record
without first establishing its minimum size. The accepted record is
later used by the initialization callback for further typed field
accesses.
Reject incomplete IRS records in the validator before either callback
can use them.
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-gic-v5.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
index 8c0303af71e7..8451b780b0ea 100644
--- a/drivers/irqchip/irq-gic-v5.c
+++ b/drivers/irqchip/irq-gic-v5.c
@@ -1309,6 +1309,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
{
struct acpi_madt_gicv5_irs *irs = (struct acpi_madt_gicv5_irs *)header;
+ if (BAD_MADT_ENTRY(irs, (unsigned long)header + header->length))
+ return false;
+
return (irs->version == ape->driver_data);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 05/12] irqchip/gic: validate MADT distributor records
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
` (2 preceding siblings ...)
2026-10-28 5:00 ` [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
4 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Marc Zyngier, Thomas Gleixner, Radu Rendec, Jason Cooper,
Will Deacon, Grant Likely, Hanjun Guo, Rafael J. Wysocki,
Catalin Marinas, linux-arm-kernel, linux-kernel
Cc: stable
The ACPI probe validator reads the version from a typed distributor
record without first establishing its size. The accepted record is then
passed to the initialization callback, which reads its base address.
Reject incomplete distributor records in the validator before either
callback accesses typed fields.
Fixes: d60fc3892c4de ("irqchip: Add GICv2 specific ACPI boot support")
Fixes: f26527b1428f ("irqchip / GIC: Convert the GIC driver to ACPI probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-gic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index a5ca04e9be64..21fcbfdc2093 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1583,6 +1583,9 @@ static bool __init gic_validate_dist(struct acpi_subtable_header *header,
struct acpi_madt_generic_distributor *dist;
dist = (struct acpi_madt_generic_distributor *)header;
+ if (BAD_MADT_ENTRY(dist, (unsigned long)header + header->length))
+ return false;
+
return (dist->version == ape->driver_data &&
(dist->version != ACPI_MADT_GIC_VERSION_NONE ||
!acpi_gic_redist_is_present()));
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
` (3 preceding siblings ...)
2026-10-28 5:00 ` [PATCH 05/12] irqchip/gic: validate MADT distributor records Jiale Yao
@ 2026-10-28 8:23 ` Marc Zyngier
4 siblings, 0 replies; 6+ messages in thread
From: Marc Zyngier @ 2026-10-28 8:23 UTC (permalink / raw)
To: Jiale Yao
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec, Huacai Chen,
WANG Xuerui, Jiaxun Yang, Anup Patel, Rafael J. Wysocki,
Sunil V L, Andrew Jones, Jonathan Cameron, Hanjun Guo,
Tomasz Nowicki, Grant Likely, Jason Cooper, Robert Richter,
Catalin Marinas, Liupu Wang, Tianyang Zhang, Jianmin Lv,
Conor Dooley, linux-riscv, linux-kernel, linux-arm-kernel,
loongarch, linux-mips
On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
>
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
>
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
>
> The issues were found by code inspection and have not been tested on real
> hardware.
How does this compare to the series posted at [1]?
No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.
M.
[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
--
Without deviation from the norm, progress is not possible.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-28 8:23 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries Jiale Yao
2026-10-28 5:00 ` [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records Jiale Yao
2026-10-28 5:00 ` [PATCH 05/12] irqchip/gic: validate MADT distributor records Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox