[PATCH 00/12] irqchip: validate remaining MADT records before use

[PATCH 00/12] irqchip: validate remaining MADT records before use

[Jiale Yao]

Several ACPI interrupt-controller callbacks cast generic MADT subtable
headers to controller-specific records and access typed fields without
first checking that the firmware supplied the complete structure. A
truncated entry can therefore cause an out-of-bounds read during early
interrupt-controller and CPU discovery.

Add the missing minimum-size checks at the callback boundaries. Records
which are passed from a probe validator to an initialization callback are
validated once in the validator, before either callback accesses them.

The issues were found by code inspection and have not been tested on real
hardware.

Jiale Yao (12):
  riscv: acpi: validate RINTC entries before use
  irqchip/gic-v5-irs: validate MADT GICC entries
  irqchip/gic-v5-irs: validate MADT IRS entries
  irqchip/gic-v5: validate MADT IRS records
  irqchip/gic: validate MADT distributor records
  irqchip/loongarch-avec: validate MADT MSI-PIC entries
  irqchip/loongarch-ir: validate MADT MSI-PIC entries
  irqchip/loongson-htvec: validate MADT BIO-PIC entries
  irqchip/loongson-htvec: validate MADT MSI-PIC entries
  irqchip/loongson-liointc: validate MADT HT-PIC entries
  irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
  irqchip/riscv-intc: validate MADT RINTC entries

 arch/riscv/kernel/acpi.c               | 3 +++
 drivers/irqchip/irq-gic-v5-irs.c       | 6 ++++++
 drivers/irqchip/irq-gic-v5.c           | 3 +++
 drivers/irqchip/irq-gic.c              | 3 +++
 drivers/irqchip/irq-loongarch-avec.c   | 3 +++
 drivers/irqchip/irq-loongarch-ir.c     | 3 +++
 drivers/irqchip/irq-loongson-htvec.c   | 6 ++++++
 drivers/irqchip/irq-loongson-liointc.c | 3 +++
 drivers/irqchip/irq-loongson-pch-pic.c | 3 +++
 drivers/irqchip/irq-riscv-intc.c       | 5 ++++-
 10 files changed, 37 insertions(+), 1 deletion(-)

-- 
2.34.1

[PATCH 06/12] irqchip/loongarch-avec: validate MADT MSI-PIC entries

[Jiale Yao]

The MSI-PIC callback reads the message address from a typed MADT record
without checking its size. Reject incomplete records before accessing
the field.

Fixes: ae16f05c928a ("irqchip/loongarch-avec: Add AVEC irqchip support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-avec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-avec.c b/drivers/irqchip/irq-loongarch-avec.c
index 53d7d23af9bb..ae12541dd167 100644
--- a/drivers/irqchip/irq-loongarch-avec.c
+++ b/drivers/irqchip/irq-loongarch-avec.c
@@ -399,6 +399,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchmsi_entry, end))
+		return -EINVAL;
+
 	loongarch_avec.msi_base_addr = pchmsi_entry->msg_address - AVEC_MSG_OFFSET;
 
 	return pch_msi_acpi_init_avec(loongarch_avec.domain);
-- 
2.34.1

[PATCH 07/12] irqchip/loongarch-ir: validate MADT MSI-PIC entries

[Jiale Yao]

The MSI-PIC callback reads the message address from a typed MADT record
without checking its size. Reject incomplete records before accessing
the field.

Fixes: 71619266e0a2 ("irqchip/loongarch-ir: Add IR (interrupt redirection) irqchip support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-ir.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-ir.c b/drivers/irqchip/irq-loongarch-ir.c
index cb4ad34da058..111173fc4612 100644
--- a/drivers/irqchip/irq-loongarch-ir.c
+++ b/drivers/irqchip/irq-loongarch-ir.c
@@ -481,6 +481,9 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header, const
 {
 	struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header;
 
+	if (BAD_MADT_ENTRY(pchmsi_entry, end))
+		return -EINVAL;
+
 	msi_base_addr = pchmsi_entry->msg_address - AVEC_MSG_OFFSET;
 
 	return pch_msi_acpi_init_avec(redirect_domain);
-- 
2.34.1

Re: [PATCH 00/12] irqchip: validate remaining MADT records before use

[Marc Zyngier]

On Wed, 28 Oct 2026 05:00:27 +0000,
Jiale Yao <yaojiale02@163.com> wrote:
> 
> Several ACPI interrupt-controller callbacks cast generic MADT subtable
> headers to controller-specific records and access typed fields without
> first checking that the firmware supplied the complete structure. A
> truncated entry can therefore cause an out-of-bounds read during early
> interrupt-controller and CPU discovery.
> 
> Add the missing minimum-size checks at the callback boundaries. Records
> which are passed from a probe validator to an initialization callback are
> validated once in the validator, before either callback accesses them.
> 
> The issues were found by code inspection and have not been tested on real
> hardware.

How does this compare to the series posted at [1]?

No version number, no change log, and not even an attempt at a QEMU
test run. If you want people to review this stuff, you need to up your
game a tiny bit.

	M.

[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com

-- 
Without deviation from the norm, progress is not possible.