[PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Jiale Yao]

IRQ chip probing invokes validation and probe callbacks after the common
table walker has only established that a generic subtable header is
readable. A malformed length can leave callback field accesses outside
the MADT.

Validate the generic header length and ensure the complete declared
entry is contained in the table before invoking IRQ chip callbacks.

Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/scan.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 0b17a7e51956..10e8d736f44b 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
 static int __init acpi_match_madt(union acpi_subtable_headers *header,
 				  const unsigned long end)
 {
+	unsigned long start = (unsigned long)header;
+
+	if (start >= end || end - start < sizeof(header->common) ||
+	    header->common.length < sizeof(header->common) ||
+	    header->common.length > end - start)
+		return -EINVAL;
+
 	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
 		if (!ape->probe_subtbl(header, end))
 			acpi_probe_count++;
-- 
2.34.1

Re: [PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Lorenzo Pieralisi]

On Thu, Oct 29, 2026 at 11:52:32AM +0800, Jiale Yao wrote:
> IRQ chip probing invokes validation and probe callbacks after the common
> table walker has only established that a generic subtable header is
> readable. A malformed length can leave callback field accesses outside
> the MADT.
> 
> Validate the generic header length and ensure the complete declared
> entry is contained in the table before invoking IRQ chip callbacks.
> 
> Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
> Cc: stable@vger.kernel.org

I don't think this patch fixes anything (actually you don't know, it
might break kernels that are currently booting).

Remove the stable tag (on the whole series, though others might have a
different opinion). If this gets merged, goes to stable and then
we discover it triggers a regression (on existing platforms whose
ACPI tables are broken but the system is working) it would be very
annoying.

> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/acpi/scan.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> index 0b17a7e51956..10e8d736f44b 100644
> --- a/drivers/acpi/scan.c
> +++ b/drivers/acpi/scan.c
> @@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
>  static int __init acpi_match_madt(union acpi_subtable_headers *header,
>  				  const unsigned long end)
>  {
> +	unsigned long start = (unsigned long)header;
> +
> +	if (start >= end || end - start < sizeof(header->common) ||
> +	    header->common.length < sizeof(header->common) ||
> +	    header->common.length > end - start)
> +		return -EINVAL;

This is a check that AFAICS could be done in acpi_parse_entries_array() once
for all (where you also know header->common is what you need checking, btw). 

Actually, what's missing there to avoid peppering the kernel with
BAD_MADT_ENTRY checks is the entry size (that we could add with a LUT).

The downsize is that by centralizing it, if anything breaks (which is
possible) we have to revert it and therefore remove the check for all
consumers.

I don't know. Rafael, all, thoughts on this ?

Thanks,
Lorenzo

> +
>  	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
>  		if (!ape->probe_subtbl(header, end))
>  			acpi_probe_count++;
> -- 
> 2.34.1
> 

Re: [PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 3:44 PM Lorenzo Pieralisi <lpieralisi@kernel.org> wrote:
>
> On Thu, Oct 29, 2026 at 11:52:32AM +0800, Jiale Yao wrote:
> > IRQ chip probing invokes validation and probe callbacks after the common
> > table walker has only established that a generic subtable header is
> > readable. A malformed length can leave callback field accesses outside
> > the MADT.
> >
> > Validate the generic header length and ensure the complete declared
> > entry is contained in the table before invoking IRQ chip callbacks.
> >
> > Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
> > Cc: stable@vger.kernel.org
>
> I don't think this patch fixes anything (actually you don't know, it
> might break kernels that are currently booting).
>
> Remove the stable tag (on the whole series, though others might have a
> different opinion). If this gets merged, goes to stable and then
> we discover it triggers a regression (on existing platforms whose
> ACPI tables are broken but the system is working) it would be very
> annoying.
>
> > Signed-off-by: Jiale Yao <yaojiale02@163.com>
> > ---
> >  drivers/acpi/scan.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> > index 0b17a7e51956..10e8d736f44b 100644
> > --- a/drivers/acpi/scan.c
> > +++ b/drivers/acpi/scan.c
> > @@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
> >  static int __init acpi_match_madt(union acpi_subtable_headers *header,
> >                                 const unsigned long end)
> >  {
> > +     unsigned long start = (unsigned long)header;
> > +
> > +     if (start >= end || end - start < sizeof(header->common) ||
> > +         header->common.length < sizeof(header->common) ||
> > +         header->common.length > end - start)
> > +             return -EINVAL;
>
> This is a check that AFAICS could be done in acpi_parse_entries_array() once
> for all (where you also know header->common is what you need checking, btw).
>
> Actually, what's missing there to avoid peppering the kernel with
> BAD_MADT_ENTRY checks is the entry size (that we could add with a LUT).
>
> The downsize is that by centralizing it, if anything breaks (which is
> possible) we have to revert it and therefore remove the check for all
> consumers.
>
> I don't know. Rafael, all, thoughts on this ?

I have concerns similar to yours: It may break systems that currently boot.

That said, I can imagine a hostile host trying to crash a CoCo guest
by exploiting this missing check.

It might be better to try to use the actual length instead of
header->common.length if the latter is too large though.

[PATCH v2 02/20] irqchip/gic-v3-its: validate MADT ITS entries

[Jiale Yao]

The MADT ITS callback reads the translator base address and ID without
checking that firmware supplied a complete generic translator record. A
truncated entry can therefore cause out-of-bounds reads.

Reject incomplete ITS entries before accessing their typed fields.

Fixes: 3f010cf19732 ("irqchip/gicv3-its: Probe ITS in the ACPI way")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 282e4bafb084..8af88eca14c2 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5736,6 +5736,9 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
 	int err;
 
 	its_entry = (struct acpi_madt_generic_translator *)header;
+	if (BAD_MADT_ENTRY(its_entry, end))
+		return -EINVAL;
+
 	memset(&res, 0, sizeof(res));
 	res.start = its_entry->base_address;
 	res.end = its_entry->base_address + ACPI_GICV3_ITS_MEM_SIZE - 1;
-- 
2.34.1

[PATCH v2 03/20] irqchip/gic-v3: validate MADT records before use

[Jiale Yao]

The GICv3 ACPI paths cast generic MADT headers to distributor,
redistributor, and CPU interface records before confirming that the
required fields are present. Truncated records can therefore cause
out-of-bounds field reads while probing or setting up virtualization data.

Validate fixed-size distributor and redistributor records before their
first field access. Use the version-aware GICC minimum size for CPU
interface records so valid entries from older ACPI revisions remain
accepted. Validate the distributor in the version callback, which runs
before the probe callback uses the same record.

Fixes: ffa7d6166a96 ("irqchip/gic-v3: Add ACPI support for GICv3/4 initialization")
Fixes: b70fb7af6715 ("irqchip/gic-v3: ACPI: Add redistributor support via GICC structures")
Fixes: 1839e576968f ("irqchip/gic-v3: Parse and export virtual GIC information")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 94873646d46f..3d10818593df 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -2301,6 +2301,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header,
 			(struct acpi_madt_generic_redistributor *)header;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_ENTRY(redist, end))
+		return -EINVAL;
+
 	redist_base = ioremap(redist->base_address, redist->length);
 	if (!redist_base) {
 		pr_err("Couldn't map GICR region @%llx\n", redist->base_address);
@@ -2327,6 +2330,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header,
 	u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/* Neither enabled or online capable means it doesn't exist, skip it */
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
@@ -2404,6 +2410,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc =
 				(struct acpi_madt_generic_interrupt *)header;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/*
 	 * If GICC is enabled and has valid gicr base address, then it means
 	 * GICR base is presented via GICC. The redistributor is only known to
@@ -2450,6 +2459,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
 	int count;
 
 	dist = (struct acpi_madt_generic_distributor *)header;
+	if (BAD_MADT_ENTRY(dist, (unsigned long)header + header->length))
+		return false;
+
 	if (dist->version != ape->driver_data)
 		return false;
 
@@ -2469,6 +2481,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea
 		(struct acpi_madt_generic_interrupt *)header;
 	static int first_madt = true;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags &
 	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
-- 
2.34.1

[PATCH v2 04/20] irqchip/gic-v5-its: validate MADT translate frames

[Jiale Yao]

The GICv5 ITS translate-frame callback accesses IDs and the base address
without checking that the MADT entry contains the complete fixed-size
record. A truncated firmware entry can therefore cause out-of-bounds
reads.

Reject incomplete translate-frame entries before using their fields.

Fixes: a97efa5ba594 ("irqchip/gic-v5: Add ACPI ITS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 28e39b065de0..dad3b95ba150 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1233,6 +1233,9 @@ static int __init gic_acpi_parse_madt_its_translate(union acpi_subtable_headers
 	int err;
 
 	its_frame = (struct acpi_madt_gicv5_translate_frame *)header;
+	if (BAD_MADT_ENTRY(its_frame, end))
+		return -EINVAL;
+
 	if (its_frame->linked_translator_id != current_its_entry->translator_id)
 		return 0;
 
-- 
2.34.1

[PATCH v2 05/20] irqchip/loongarch-cpu: validate MADT LIO-PIC entries

[Jiale Yao]

The LIO-PIC MADT callback passes a typed record to the controller
initialization code without checking that the complete record is
present. A truncated firmware entry can therefore lead to out-of-bounds
field reads.

Reject incomplete LIO-PIC entries before passing them to the
initialization helper.

Fixes: b2d3e3354e2a ("irqchip: Add LoongArch CPU interrupt controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-cpu.c b/drivers/irqchip/irq-loongarch-cpu.c
index 84ce24889488..6185825477f4 100644
--- a/drivers/irqchip/irq-loongarch-cpu.c
+++ b/drivers/irqchip/irq-loongarch-cpu.c
@@ -119,6 +119,9 @@ static int __init liointc_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_lio_pic *liointc_entry = (struct acpi_madt_lio_pic *)header;
 
+	if (BAD_MADT_ENTRY(liointc_entry, end))
+		return -EINVAL;
+
 	return liointc_acpi_init(irq_domain, liointc_entry);
 }
 
-- 
2.34.1

[PATCH v2 06/20] irqchip/loongson-eiointc: validate MADT BIO-PIC entries

[Jiale Yao]

The BIO-PIC MADT callback reads the controller address before checking
that firmware supplied the complete fixed-size record. A truncated entry
can therefore cause an out-of-bounds read while selecting the parent
domain.

Validate the BIO-PIC record before accessing its address or passing it
to the initialization helper.

Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
index ba6e8480e383..1b90edef5a52 100644
--- a/drivers/irqchip/irq-loongson-eiointc.c
+++ b/drivers/irqchip/irq-loongson-eiointc.c
@@ -454,8 +454,14 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
 					const unsigned long end)
 {
 	struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
-	unsigned int node = pa_to_nid(pchpic_entry->address) & 0xf;
-	struct irq_domain *parent = acpi_get_vec_parent(node, pch_group);
+	struct irq_domain *parent;
+	unsigned int node;
+
+	if (BAD_MADT_ENTRY(pchpic_entry, end))
+		return -EINVAL;
+
+	node = pa_to_nid(pchpic_entry->address) & 0xf;
+	parent = acpi_get_vec_parent(node, pch_group);
 
 	if (parent)
 		return pch_pic_acpi_init(parent, pchpic_entry);
-- 
2.34.1

[PATCH v2 07/20] riscv: validate RINTC entries before use

[Jiale Yao]

The RINTC parser reads the flags field before checking that the MADT
entry contains a complete RINTC structure. A truncated firmware record
can therefore trigger an out-of-bounds read during early CPU discovery.

Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
access.

Fixes: ce92546cd637 ("RISC-V: smpboot: Add ACPI support in setup_smp()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/smpboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index a9de2dae804c..9c341398058c 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	static bool found_boot_cpu;
 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
 
+	if (BAD_MADT_ENTRY(processor, end))
+		return -EINVAL;
+
 	/*
 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
 	 * bit in the flag is not enabled, it means OS should not try to enable
@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	if (!(processor->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-	if (BAD_MADT_ENTRY(processor, end))
-		return -EINVAL;
-
 	acpi_table_print_madt_entry(&header->common);
 
 	hart = processor->hart_id;
-- 
2.34.1

[PATCH v2 08/20] ACPI: riscv: validate interrupt controller MADT entries

[Jiale Yao]

The PLIC and APLIC MADT callbacks cast generic subtable headers to
fixed-size records before checking that the complete records are
present. Truncated firmware entries can therefore cause out-of-bounds
field reads.

Reject entries that do not contain the complete controller-specific
structure before registering an interrupt controller.

Fixes: e77b8dc02a1c ("ACPI: RISC-V: Initialize GSI mapping structures")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/riscv/irq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index da2c42e0ebfd..1f6fee5c5746 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -220,6 +220,9 @@ static int __init riscv_acpi_aplic_parse_madt(union acpi_subtable_headers *heade
 {
 	struct acpi_madt_aplic *aplic = (struct acpi_madt_aplic *)header;
 
+	if (BAD_MADT_ENTRY(aplic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(aplic->gsi_base, aplic->num_sources, aplic->num_idcs,
 					    aplic->id, ACPI_RISCV_IRQCHIP_APLIC);
 }
@@ -229,6 +232,9 @@ static int __init riscv_acpi_plic_parse_madt(union acpi_subtable_headers *header
 {
 	struct acpi_madt_plic *plic = (struct acpi_madt_plic *)header;
 
+	if (BAD_MADT_ENTRY(plic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(plic->gsi_base, plic->num_irqs, 0,
 					    plic->id, ACPI_RISCV_IRQCHIP_PLIC);
 }
-- 
2.34.1

[PATCH v2 09/20] riscv: acpi: validate RINTC entries before use

[Jiale Yao]

The RINTC callback reads flags and other fields from a typed MADT record
without checking that the complete record is present. A truncated
firmware entry can therefore cause out-of-bounds reads during CPU map
initialization.

Reject incomplete RINTC entries before accessing typed fields.

Fixes: f99561199470 ("RISC-V: ACPI: Cache and retrieve the RINTC structure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/acpi.c b/arch/riscv/kernel/acpi.c
index efd52a5d05b5..9e0658c6a869 100644
--- a/arch/riscv/kernel/acpi.c
+++ b/arch/riscv/kernel/acpi.c
@@ -171,6 +171,9 @@ static int acpi_parse_madt_rintc(union acpi_subtable_headers *header, const unsi
 	struct acpi_madt_rintc *rintc = (struct acpi_madt_rintc *)header;
 	int cpuid;
 
+	if (BAD_MADT_ENTRY(rintc, end))
+		return -EINVAL;
+
 	if (!(rintc->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-- 
2.34.1

[PATCH v2 10/20] irqchip/gic-v5-irs: validate MADT GICC entries

[Jiale Yao]

The IAFFID parser reads fields from a typed GICC record without checking
that the MADT entry contains the fields it accesses. Reject truncated
entries before reading them.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-irs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 9d60f474aa4f..4e60a1caaba5 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -891,6 +891,9 @@ static int __init gic_acpi_parse_iaffid(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc = (struct acpi_madt_generic_interrupt *)header;
 	int cpu;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
 
-- 
2.34.1