[PATCH 0/2] RISC-V: validate ACPI MADT entries before use

[PATCH 0/2] RISC-V: validate ACPI MADT entries before use

[Jiale Yao]

RISC-V ACPI initialization passes generic MADT subtable headers to
RINTC, PLIC, and APLIC parsers.  These parsers currently access fields
from the fixed-size records before establishing that firmware supplied
the complete structure.  A truncated MADT entry can therefore cause an
out-of-bounds read during early interrupt and CPU setup.

Validate each typed record before its first field access.  The first
patch fixes the CPU RINTC parser and the second covers the PLIC and APLIC
interrupt-controller parsers.

Jiale Yao (2):
  riscv: validate RINTC entries before use
  ACPI: riscv: validate interrupt controller MADT entries

 arch/riscv/kernel/smpboot.c | 6 +++---
 drivers/acpi/riscv/irq.c    | 6 ++++++
 2 files changed, 9 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/2] riscv: validate RINTC entries before use

[Jiale Yao]

The RINTC parser reads the flags field before checking that the MADT
entry contains a complete RINTC structure. A truncated firmware record
can therefore trigger an out-of-bounds read during early CPU discovery.

Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
access.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/smpboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index a9de2dae804c..9c341398058c 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	static bool found_boot_cpu;
 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
 
+	if (BAD_MADT_ENTRY(processor, end))
+		return -EINVAL;
+
 	/*
 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
 	 * bit in the flag is not enabled, it means OS should not try to enable
@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	if (!(processor->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-	if (BAD_MADT_ENTRY(processor, end))
-		return -EINVAL;
-
 	acpi_table_print_madt_entry(&header->common);
 
 	hart = processor->hart_id;
-- 
2.34.1

Re:[PATCH 1/2] riscv: validate RINTC entries before use

[jiale yao]

At 2026-10-16 22:12:47, "Jiale Yao" <yaojiale02@163.com> wrote:
>The RINTC parser reads the flags field before checking that the MADT
>entry contains a complete RINTC structure. A truncated firmware record
>can therefore trigger an out-of-bounds read during early CPU discovery.
>
>Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
>access.
>

Fixes: ce92546cd637 ("RISC-V: smpboot: Add ACPI support in setup_smp()")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> arch/riscv/kernel/smpboot.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
>index a9de2dae804c..9c341398058c 100644
>--- a/arch/riscv/kernel/smpboot.c
>+++ b/arch/riscv/kernel/smpboot.c
>@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
> 	static bool found_boot_cpu;
> 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
> 
>+	if (BAD_MADT_ENTRY(processor, end))
>+		return -EINVAL;
>+
> 	/*
> 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
> 	 * bit in the flag is not enabled, it means OS should not try to enable
>@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
> 	if (!(processor->flags & ACPI_MADT_ENABLED))
> 		return 0;
> 
>-	if (BAD_MADT_ENTRY(processor, end))
>-		return -EINVAL;
>-
> 	acpi_table_print_madt_entry(&header->common);
> 
> 	hart = processor->hart_id;
>-- 
>2.34.1

[PATCH 2/2] ACPI: riscv: validate interrupt controller MADT entries

[Jiale Yao]

The PLIC and APLIC MADT callbacks cast generic subtable headers to
fixed-size records before checking that the complete records are
present. Truncated firmware entries can therefore cause out-of-bounds
field reads.

Reject entries that do not contain the complete controller-specific
structure before registering an interrupt controller.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/riscv/irq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index da2c42e0ebfd..1f6fee5c5746 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -220,6 +220,9 @@ static int __init riscv_acpi_aplic_parse_madt(union acpi_subtable_headers *heade
 {
 	struct acpi_madt_aplic *aplic = (struct acpi_madt_aplic *)header;
 
+	if (BAD_MADT_ENTRY(aplic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(aplic->gsi_base, aplic->num_sources, aplic->num_idcs,
 					    aplic->id, ACPI_RISCV_IRQCHIP_APLIC);
 }
@@ -229,6 +232,9 @@ static int __init riscv_acpi_plic_parse_madt(union acpi_subtable_headers *header
 {
 	struct acpi_madt_plic *plic = (struct acpi_madt_plic *)header;
 
+	if (BAD_MADT_ENTRY(plic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(plic->gsi_base, plic->num_irqs, 0,
 					    plic->id, ACPI_RISCV_IRQCHIP_PLIC);
 }
-- 
2.34.1

Re:[PATCH 2/2] ACPI: riscv: validate interrupt controller MADT entries

[jiale yao]

At 2026-10-16 22:12:48, "Jiale Yao" <yaojiale02@163.com> wrote:
>The PLIC and APLIC MADT callbacks cast generic subtable headers to
>fixed-size records before checking that the complete records are
>present. Truncated firmware entries can therefore cause out-of-bounds
>field reads.
>
>Reject entries that do not contain the complete controller-specific
>structure before registering an interrupt controller.
>

Fixes: e77b8dc02a1c ("ACPI: RISC-V: Initialize GSI mapping structures")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> drivers/acpi/riscv/irq.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
>index da2c42e0ebfd..1f6fee5c5746 100644
>--- a/drivers/acpi/riscv/irq.c
>+++ b/drivers/acpi/riscv/irq.c
>@@ -220,6 +220,9 @@ static int __init riscv_acpi_aplic_parse_madt(union acpi_subtable_headers *heade
> {
> 	struct acpi_madt_aplic *aplic = (struct acpi_madt_aplic *)header;
> 
>+	if (BAD_MADT_ENTRY(aplic, end))
>+		return -EINVAL;
>+
> 	return riscv_acpi_register_ext_intc(aplic->gsi_base, aplic->num_sources, aplic->num_idcs,
> 					    aplic->id, ACPI_RISCV_IRQCHIP_APLIC);
> }
>@@ -229,6 +232,9 @@ static int __init riscv_acpi_plic_parse_madt(union acpi_subtable_headers *header
> {
> 	struct acpi_madt_plic *plic = (struct acpi_madt_plic *)header;
> 
>+	if (BAD_MADT_ENTRY(plic, end))
>+		return -EINVAL;
>+
> 	return riscv_acpi_register_ext_intc(plic->gsi_base, plic->num_irqs, 0,
> 					    plic->id, ACPI_RISCV_IRQCHIP_PLIC);
> }
>-- 
>2.34.1