From: "jiale yao" <19888972804@163.com>
To: "Marc Zyngier" <maz@kernel.org>
Cc: "Paul Walmsley" <pjw@kernel.org>,
"Palmer Dabbelt" <palmer@dabbelt.com>,
"Albert Ou" <aou@eecs.berkeley.edu>,
"Alexandre Ghiti" <alex@ghiti.fr>,
"Lorenzo Pieralisi" <lpieralisi@kernel.org>,
"Thomas Gleixner" <tglx@kernel.org>,
"Radu Rendec" <radu@rendec.net>,
"Huacai Chen" <chenhuacai@kernel.org>,
"WANG Xuerui" <kernel@xen0n.name>,
"Jiaxun Yang" <jiaxun.yang@flygoat.com>,
"Anup Patel" <anup@brainfault.org>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
"Sunil V L" <sunilvl@ventanamicro.com>,
"Andrew Jones" <andrew.jones@linux.dev>,
"Jonathan Cameron" <jic23@kernel.org>,
"Hanjun Guo" <guohanjun@huawei.com>,
"Tomasz Nowicki" <tomasz.nowicki@linaro.org>,
"Grant Likely" <grant.likely@linaro.org>,
"Jason Cooper" <jason@lakedaemon.net>,
"Robert Richter" <rrichter@cavium.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
"Liupu Wang" <wangliupu@loongson.cn>,
"Tianyang Zhang" <zhangtianyang@loongson.cn>,
"Jianmin Lv" <lvjianmin@loongson.cn>,
"Conor Dooley" <conor.dooley@microchip.com>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev,
linux-mips@vger.kernel.org
Subject: Re:Re: [PATCH 00/12] irqchip: validate remaining MADT records before use
Date: Thu, 29 Oct 2026 12:01:31 +0800 (CST) [thread overview]
Message-ID: <2625137e.39a5.1a185d1f222.Coremail.19888972804@163.com> (raw)
In-Reply-To: <86qzhaxmh5.wl-maz@kernel.org>
At 2026-10-28 16:23:18, "Marc Zyngier" <maz@kernel.org> wrote:
>On Wed, 28 Oct 2026 05:00:27 +0000,
>Jiale Yao <yaojiale02@163.com> wrote:
>>
>> Several ACPI interrupt-controller callbacks cast generic MADT subtable
>> headers to controller-specific records and access typed fields without
>> first checking that the firmware supplied the complete structure. A
>> truncated entry can therefore cause an out-of-bounds read during early
>> interrupt-controller and CPU discovery.
>>
>> Add the missing minimum-size checks at the callback boundaries. Records
>> which are passed from a probe validator to an initialization callback are
>> validated once in the validator, before either callback accesses them.
>>
>> The issues were found by code inspection and have not been tested on real
>> hardware.
>
>How does this compare to the series posted at [1]?
>
>No version number, no change log, and not even an attempt at a QEMU
>test run. If you want people to review this stuff, you need to up your
>game a tiny bit.
>
> M.
>
>[1] https://lore.kernel.org/20261021144524.364143-1-yaojiale02@163.com
Thanks for your review, I have added test information, with a new series.
https://lore.kernel.org/lkml/20261029035253.2333852-1-yaojiale02@163.com/
>
>--
>Without deviation from the norm, progress is not possible.
prev parent reply other threads:[~2026-10-29 4:04 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 5:00 Jiale Yao
2026-10-28 5:00 ` [PATCH 01/12] riscv: acpi: validate RINTC entries " Jiale Yao
2026-10-28 5:00 ` [PATCH 02/12] irqchip/gic-v5-irs: validate MADT GICC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 03/12] irqchip/gic-v5-irs: validate MADT IRS entries Jiale Yao
2026-10-28 5:00 ` [PATCH 04/12] irqchip/gic-v5: validate MADT IRS records Jiale Yao
2026-10-28 5:00 ` [PATCH 05/12] irqchip/gic: validate MADT distributor records Jiale Yao
2026-10-28 5:00 ` [PATCH 06/12] irqchip/loongarch-avec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 07/12] irqchip/loongarch-ir: " Jiale Yao
2026-10-28 5:00 ` [PATCH 08/12] irqchip/loongson-htvec: validate MADT BIO-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 09/12] irqchip/loongson-htvec: validate MADT MSI-PIC entries Jiale Yao
2026-10-28 5:00 ` [PATCH 10/12] irqchip/loongson-liointc: validate MADT HT-PIC entries Jiale Yao
2026-10-28 8:23 ` [PATCH 00/12] irqchip: validate remaining MADT records before use Marc Zyngier
2026-10-29 4:01 ` jiale yao [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2625137e.39a5.1a185d1f222.Coremail.19888972804@163.com \
--to=19888972804@163.com \
--cc=alex@ghiti.fr \
--cc=andrew.jones@linux.dev \
--cc=anup@brainfault.org \
--cc=aou@eecs.berkeley.edu \
--cc=catalin.marinas@arm.com \
--cc=chenhuacai@kernel.org \
--cc=conor.dooley@microchip.com \
--cc=grant.likely@linaro.org \
--cc=guohanjun@huawei.com \
--cc=jason@lakedaemon.net \
--cc=jiaxun.yang@flygoat.com \
--cc=jic23@kernel.org \
--cc=kernel@xen0n.name \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=loongarch@lists.linux.dev \
--cc=lpieralisi@kernel.org \
--cc=lvjianmin@loongson.cn \
--cc=maz@kernel.org \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
--cc=radu@rendec.net \
--cc=rafael.j.wysocki@intel.com \
--cc=rrichter@cavium.com \
--cc=sunilvl@ventanamicro.com \
--cc=tglx@kernel.org \
--cc=tomasz.nowicki@linaro.org \
--cc=wangliupu@loongson.cn \
--cc=zhangtianyang@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®