* [PATCH 00/12] irqchip: validate remaining MADT records before use
@ 2026-10-28 5:00 Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Marc Zyngier, Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec,
Huacai Chen, WANG Xuerui, Jiaxun Yang, Anup Patel,
Rafael J. Wysocki, Sunil V L, Andrew Jones, Jonathan Cameron,
Hanjun Guo, Tomasz Nowicki, Grant Likely, Jason Cooper,
Robert Richter, Catalin Marinas, Liupu Wang, Tianyang Zhang,
Jianmin Lv, Conor Dooley, linux-riscv, linux-kernel,
linux-arm-kernel, loongarch, linux-mips
Several ACPI interrupt-controller callbacks cast generic MADT subtable
headers to controller-specific records and access typed fields without
first checking that the firmware supplied the complete structure. A
truncated entry can therefore cause an out-of-bounds read during early
interrupt-controller and CPU discovery.
Add the missing minimum-size checks at the callback boundaries. Records
which are passed from a probe validator to an initialization callback are
validated once in the validator, before either callback accesses them.
The issues were found by code inspection and have not been tested on real
hardware.
Jiale Yao (12):
riscv: acpi: validate RINTC entries before use
irqchip/gic-v5-irs: validate MADT GICC entries
irqchip/gic-v5-irs: validate MADT IRS entries
irqchip/gic-v5: validate MADT IRS records
irqchip/gic: validate MADT distributor records
irqchip/loongarch-avec: validate MADT MSI-PIC entries
irqchip/loongarch-ir: validate MADT MSI-PIC entries
irqchip/loongson-htvec: validate MADT BIO-PIC entries
irqchip/loongson-htvec: validate MADT MSI-PIC entries
irqchip/loongson-liointc: validate MADT HT-PIC entries
irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
irqchip/riscv-intc: validate MADT RINTC entries
arch/riscv/kernel/acpi.c | 3 +++
drivers/irqchip/irq-gic-v5-irs.c | 6 ++++++
drivers/irqchip/irq-gic-v5.c | 3 +++
drivers/irqchip/irq-gic.c | 3 +++
drivers/irqchip/irq-loongarch-avec.c | 3 +++
drivers/irqchip/irq-loongarch-ir.c | 3 +++
drivers/irqchip/irq-loongson-htvec.c | 6 ++++++
drivers/irqchip/irq-loongson-liointc.c | 3 +++
drivers/irqchip/irq-loongson-pch-pic.c | 3 +++
drivers/irqchip/irq-riscv-intc.c | 5 ++++-
10 files changed, 37 insertions(+), 1 deletion(-)
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries Jiale Yao
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Huacai Chen, Jiaxun Yang, Thomas Gleixner, Radu Rendec,
Jianmin Lv, Marc Zyngier, linux-mips, linux-kernel
Cc: stable
The HT-vector cascade callback passes a typed BIO-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.
Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-loongson-htvec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
index 75e40ba6069d..725f30b7574b 100644
--- a/drivers/irqchip/irq-loongson-htvec.c
+++ b/drivers/irqchip/irq-loongson-htvec.c
@@ -269,6 +269,9 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
{
struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
+ if (BAD_MADT_ENTRY(pchpic_entry, end))
+ return -EINVAL;
+
return pch_pic_acpi_init(htvec_priv->htvec_domain, pchpic_entry);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 5:00 ` [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
3 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Huacai Chen, Jiaxun Yang, Thomas Gleixner, Radu Rendec,
Jianmin Lv, Marc Zyngier, linux-mips, linux-kernel
Cc: stable
The HT-vector cascade callback passes a typed MSI-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.
Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-loongson-htvec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
index 725f30b7574b..1f5bf01c3183 100644
--- a/drivers/irqchip/irq-loongson-htvec.c
+++ b/drivers/irqchip/irq-loongson-htvec.c
@@ -280,6 +280,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header,
{
struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
+ if (BAD_MADT_ENTRY(pchmsi_entry, end))
+ return -EINVAL;
+
return pch_msi_acpi_init(htvec_priv->htvec_domain, pchmsi_entry);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries Jiale Yao
@ 2026-10-28 5:00 ` Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
3 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:00 UTC (permalink / raw)
To: Huacai Chen, Jiaxun Yang, Thomas Gleixner, Radu Rendec,
Marc Zyngier, Jianmin Lv, linux-mips, linux-kernel
Cc: stable
The LIOINTC cascade callback passes a typed HT-PIC record to
initialization code without checking that the complete structure is
present. Reject truncated entries before dispatching them.
Fixes: 70f7b6c008b3 ("irqchip/loongson-htvec: Add ACPI init support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/irqchip/irq-loongson-liointc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/irqchip/irq-loongson-liointc.c b/drivers/irqchip/irq-loongson-liointc.c
index cf44a333b9c8..2b6fdf9eff42 100644
--- a/drivers/irqchip/irq-loongson-liointc.c
+++ b/drivers/irqchip/irq-loongson-liointc.c
@@ -378,6 +378,9 @@ static int __init htintc_parse_madt(union acpi_subtable_headers *header,
struct acpi_madt_ht_pic *htintc_entry = (struct acpi_madt_ht_pic *)header;
struct irq_domain *parent = irq_find_matching_fwnode(liointc_handle, DOMAIN_BUS_ANY);
+ if (BAD_MADT_ENTRY(htintc_entry, end))
+ return -EINVAL;
+
return htvec_acpi_init(parent, htintc_entry);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
` (2 preceding siblings ...)
2026-10-28 5:00 ` [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries Jiale Yao
@ 2026-10-28 8:23 ` Marc Zyngier
2026-10-29 4:01 ` jiale yao
3 siblings, 1 reply; 6+ messages in thread
From: Marc Zyngier @ 2026-10-28 8:23 UTC (permalink / raw)
To: Jiale Yao
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec, Huacai Chen,
WANG Xuerui, Jiaxun Yang, Anup Patel, Rafael J. Wysocki,
Sunil V L, Andrew Jones, Jonathan Cameron, Hanjun Guo,
Tomasz Nowicki, Grant Likely, Jason Cooper, Robert Richter,
Catalin Marinas, Liupu Wang, Tianyang Zhang, Jianmin Lv,
Conor Dooley, linux-riscv, linux-kernel, linux-arm-kernel,
loongarch, linux-mips
On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
>
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
>
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
>
> The issues were found by code inspection and have not been tested on real
> hardware.
How does this compare to the series posted at [1]?
No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.
M.
[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
--
Without deviation from the norm, progress is not possible.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re:Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
@ 2026-10-29 4:01 ` jiale yao
0 siblings, 0 replies; 6+ messages in thread
From: jiale yao @ 2026-10-29 4:01 UTC (permalink / raw)
To: Marc Zyngier
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Lorenzo Pieralisi, Thomas Gleixner, Radu Rendec, Huacai Chen,
WANG Xuerui, Jiaxun Yang, Anup Patel, Rafael J. Wysocki,
Sunil V L, Andrew Jones, Jonathan Cameron, Hanjun Guo,
Tomasz Nowicki, Grant Likely, Jason Cooper, Robert Richter,
Catalin Marinas, Liupu Wang, Tianyang Zhang, Jianmin Lv,
Conor Dooley, linux-riscv, linux-kernel, linux-arm-kernel,
loongarch, linux-mips
At 2026-10-28 16:23:18, "Marc Zyngier" <maz@kernel.org> wrote:
>On Wed, 28 Oct 2026 05:00:27 +0000,
>Jiale Yao <yaojiale02@163.com> wrote:
>>
>> Several ACPI interrupt-controller callbacks cast generic MADT subtable
>> headers to controller-specific records and access typed fields without
>> first checking that the firmware supplied the complete structure. A
>> truncated entry can therefore cause an out-of-bounds read during early
>> interrupt-controller and CPU discovery.
>>
>> Add the missing minimum-size checks at the callback boundaries. Records
>> which are passed from a probe validator to an initialization callback are
>> validated once in the validator, before either callback accesses them.
>>
>> The issues were found by code inspection and have not been tested on real
>> hardware.
>
>How does this compare to the series posted at [1]?
>
>No version number, no change log, and not even an attempt at a QEMU
>test run. If you want people to review this stuff, you need to up your
>game a tiny bit.
>
> M.
>
>[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
Thanks for your review, I have added test information, with a new series.
https://lore.kernel.org/lkml/20261029035253.2333852-1-yaojiale02@163.com/
>
>--
>Without deviation from the norm, progress is not possible.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-29 4:04 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
2026-10-29 4:01 ` jiale yao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox