From: Marc Zyngier <maz@kernel.org>
To: Jiale Yao <yaojiale02@163.com>
Cc: Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexandre Ghiti <alex@ghiti.fr>,
Lorenzo Pieralisi <lpieralisi@kernel.org>,
Thomas Gleixner <tglx@kernel.org>, Radu Rendec <radu@rendec.net>,
Huacai Chen <chenhuacai@kernel.org>,
WANG Xuerui <kernel@xen0n.name>,
Jiaxun Yang <jiaxun.yang@flygoat.com>,
Anup Patel <anup@brainfault.org>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
Sunil V L <sunilvl@ventanamicro.com>,
Andrew Jones <andrew.jones@linux.dev>,
Jonathan Cameron <jic23@kernel.org>,
Hanjun Guo <guohanjun@huawei.com>,
Tomasz Nowicki <tomasz.nowicki@linaro.org>,
Grant Likely <grant.likely@linaro.org>,
Jason Cooper <jason@lakedaemon.net>,
Robert Richter <rrichter@cavium.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Liupu Wang <wangliupu@loongson.cn>,
Tianyang Zhang <zhangtianyang@loongson.cn>,
Jianmin Lv <lvjianmin@loongson.cn>,
Conor Dooley <conor.dooley@microchip.com>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev,
linux-mips@vger.kernel.org
Subject: Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
Date: Wed, 28 Oct 2026 08:23:18 +0000 [thread overview]
Message-ID: <86qzhaxmh5.wl-maz@kernel.org> (raw)
In-Reply-To: <20261028050039.121080-1-yaojiale02@163.com>
On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
>
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
>
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
>
> The issues were found by code inspection and have not been tested on real
> hardware.
How does this compare to the series posted at [1]?
No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.
M.
[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
--
Without deviation from the norm, progress is not possible.
prev parent reply other threads:[~2026-10-28 8:23 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 5:00 [PATCH 00/12] irqchip: validate remaining MADT records before use Jiale Yao
2026-10-28 5:00 ` [PATCH 06/12] irqchip/loongarch-avec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 07/12] irqchip/loongarch-ir: " Jiale Yao
2026-10-28 8:23 ` Marc Zyngier [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=86qzhaxmh5.wl-maz@kernel.org \
--to=maz@kernel.org \
--cc=alex@ghiti.fr \
--cc=andrew.jones@linux.dev \
--cc=anup@brainfault.org \
--cc=aou@eecs.berkeley.edu \
--cc=catalin.marinas@arm.com \
--cc=chenhuacai@kernel.org \
--cc=conor.dooley@microchip.com \
--cc=grant.likely@linaro.org \
--cc=guohanjun@huawei.com \
--cc=jason@lakedaemon.net \
--cc=jiaxun.yang@flygoat.com \
--cc=jic23@kernel.org \
--cc=kernel@xen0n.name \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=loongarch@lists.linux.dev \
--cc=lpieralisi@kernel.org \
--cc=lvjianmin@loongson.cn \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
--cc=radu@rendec.net \
--cc=rafael.j.wysocki@intel.com \
--cc=rrichter@cavium.com \
--cc=sunilvl@ventanamicro.com \
--cc=tglx@kernel.org \
--cc=tomasz.nowicki@linaro.org \
--cc=wangliupu@loongson.cn \
--cc=yaojiale02@163.com \
--cc=zhangtianyang@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox