From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 412813546E9 for ; Fri, 16 Oct 2026 14:36:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792161414; cv=none; b=ieip2p3Eqd6zouwYcXsPfunv4mwaX2Noapmn6J/nefXywxgXX01M4jo+xvHYfpe7xhqqWihdjPQvCUgBVjRKmcmZE44tDz24XwRBeBkddNUl7VgAOHMh+4QwByHssNXEsCyS4626TS8ZJsDchAebBOmJdLBaxrits8wG094vthk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792161414; c=relaxed/simple; bh=3pcQWRv8O1PZqdGhSiNo4olhsUP3bojkSnLBY2ntEDM=; h=Date:Message-ID:From:To:Cc:Subject:In-Reply-To:References: MIME-Version:Content-Type; b=qTTjRfnsfmJy+t6dTyceLEvk9YFe+Lfg1DH7bjyAGoSqgd6Z5D8g9ggQsjdwjqZSJ+DPQnF0cme7JByWkARLAFvKuCCl22+SZloIMx9F4iylv7Hj4T7fgtV2z3nhWtBsgCnvnfQ6XeikHn4aAu87O8fZxExDR+QOftG6p1lEw8I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hHm9Yjai; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hHm9Yjai" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1F0D1F000C4; Fri, 16 Oct 2026 14:36:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792161412; bh=uflAwfv4pgBe00mPZASrj8nK8vm7+mx19rpyox+Hzkk=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=hHm9YjaiPam4pOBh45KFrpmp+76rcRCkKwZmdOjW9Q7QCW7vJ+GLhmIG+2LrhraQ/ jYZ6jPUgTOxtyANFNfA9Hrf3jGX5dj0wo7tjWAkhedvR5D2LhzCSR4vuiPQ2KX38Wk e9ARjisbV1UnbuuCHa6RAA1BWvTgVm59XR7zYbPd7mfSC/b2HpaLhntWv7qHiVXK0J 5R6cCLldRhZ/YBzPbNTQtFDnBZ3tnpefVfNXvpWC90ZnOTquajBoM0iR0RPhTAdr7X uPdm0kftJHGYwEIlc3DKpPN0jKU5MdJMFZJEO4CFKdbGWXl1c3wLf704IvnWCOuHmF Dt9H+mSZ4CeOQ== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xHj3C-00000003ndV-2mXh; Fri, 16 Oct 2026 14:36:50 +0000 Date: Fri, 16 Oct 2026 15:36:50 +0100 Message-ID: <868q3x1zlp.wl-maz@kernel.org> From: Marc Zyngier To: Jiale Yao Cc: Thomas Gleixner , Radu Rendec , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 3/6] irqchip/gic-v3: validate MADT records before use In-Reply-To: <20261016141357.2793046-4-yaojiale02@163.com> References: <20261016141357.2793046-1-yaojiale02@163.com> <20261016141357.2793046-4-yaojiale02@163.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: yaojiale02@163.com, tglx@kernel.org, radu@rendec.net, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false On Fri, 16 Oct 2026 15:13:54 +0100, Jiale Yao wrote: > > The GICv3 ACPI paths cast generic MADT headers to distributor, > redistributor, and CPU interface records before confirming that the > corresponding fixed-size structures are present. Truncated records can > therefore cause out-of-bounds field reads while probing or setting up > virtualization data. > > Check each typed MADT record before its first field access. Also reject > a short distributor record in the version validator, which runs before > the probe callback. > > Signed-off-by: Jiale Yao > --- > drivers/irqchip/irq-gic-v3.c | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > > diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c > index 6e1fa5b247fc..0588d6d83b31 100644 > --- a/drivers/irqchip/irq-gic-v3.c > +++ b/drivers/irqchip/irq-gic-v3.c > @@ -2299,6 +2299,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header, > (struct acpi_madt_generic_redistributor *)header; > void __iomem *redist_base; > > + if (BAD_MADT_ENTRY(redist, end)) > + return -EINVAL; > + > redist_base = ioremap(redist->base_address, redist->length); > if (!redist_base) { > pr_err("Couldn't map GICR region @%llx\n", redist->base_address); > @@ -2325,6 +2328,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header, > u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2; > void __iomem *redist_base; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + > /* Neither enabled or online capable means it doesn't exist, skip it */ > if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE))) > return 0; > @@ -2391,6 +2397,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header, > struct acpi_madt_generic_interrupt *gicc = > (struct acpi_madt_generic_interrupt *)header; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + > /* > * If GICC is enabled and has valid gicr base address, then it means > * GICR base is presented via GICC. The redistributor is only known to > @@ -2437,6 +2446,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header, > int count; > > dist = (struct acpi_madt_generic_distributor *)header; > + if (header->length < sizeof(*dist)) > + return false; > + Why is this open-coded instead of using the checking macro? > if (dist->version != ape->driver_data) > return false; > > @@ -2457,6 +2469,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea > int maint_irq_mode; > static int first_madt = true; > > + if (BAD_MADT_ENTRY(gicc, end)) > + return -EINVAL; > + Why isn't this using BAD_MADT_GICC_ENTRY()? > if (!(gicc->flags & > (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE))) > return 0; > @@ -2547,6 +2562,9 @@ gic_acpi_init(union acpi_subtable_headers *header, const unsigned long end) > > /* Get distributor base address */ > dist = (struct acpi_madt_generic_distributor *)header; > + if (BAD_MADT_ENTRY(dist, end)) > + return -EINVAL; > + Why does this need to be re-checked if the validation phased has succeeded? > acpi_data.dist_base = ioremap(dist->base_address, > ACPI_GICV3_DIST_MEM_SIZE); > if (!acpi_data.dist_base) { Thanks, M. -- Without deviation from the norm, progress is not possible.