[PATCH v2 00/20] ACPI/irqchip: validate MADT entries before use

[PATCH v2 00/20] ACPI/irqchip: validate MADT entries before use

[Jiale Yao]

ACPI interrupt-controller setup passes firmware-supplied MADT subtables
to architecture and irqchip callbacks.  The common table walker only
guarantees that a generic subtable header is readable.  A number of
callbacks cast that header to a larger controller-specific structure and
read typed fields before checking that the complete record is present.
Truncated records can therefore cause out-of-bounds reads during early
CPU and interrupt-controller discovery.

This series combines the previously posted generic/irqchip series [1],
the RISC-V series [2], and the remaining MADT callback checks into one
set.  The common irqchip probe path first rejects entries whose declared
range leaves the table.  Each parser then validates the minimum size of
the concrete record before its first typed access.

Testing
=======

The RISC-V cases were tested with qemu-system-riscv64, EDK2 pflash
firmware, a KASAN-enabled kernel, CONFIG_ACPI_TABLE_UPGRADE=y, and an
uncompressed initramfs containing an overriding MADT.  The malformed
table is one page long and ends with a three-byte RINTC entry, while a
complete struct acpi_madt_rintc is 36 bytes.

On an unpatched kernel the override was accepted and setup_smp() faulted
in acpi_parse_rintc() while reading processor->flags four bytes from the
start of the truncated record.  The record starts three bytes before the
end of the mapped page, so that read entered the following unmapped page:

  Unable to handle kernel paging request
  epc : acpi_parse_rintc+0x46/0x206
  cause: 000000000000000d
  Kernel panic - not syncing: Attempted to kill the idle task!

Applying only the old arch/riscv/kernel/acpi.c and
drivers/irqchip/irq-riscv-intc.c checks produced the same fault because
the setup_smp() parser runs first.  With patch 7 moving the existing
BAD_MADT_ENTRY() check before the flags read, plus patches 9 and 20, the
out-of-bounds access disappeared.  The malformed table was rejected and
the kernel later stopped at the existing acpi_init_rintc_map() BUG for a
machine with no valid RINTC entries.  This is the current fail-closed
behavior; it is not an out-of-bounds access.

The LoongArch LPC-PIC case was exercised with an overriding MADT ending
in a three-byte LPC-PIC entry.  Temporary diagnostic instrumentation in
pch_lpc_parse_madt() reported:

  decl_len=3 sizeof=14 beyond_end=11

This confirms the field accesses covered by patch 19 extend eleven bytes
beyond the supplied record.  LoongArch maps this early table directly,
so the read did not itself cause a page fault.

Dynamic test coverage by patch is therefore:

  7       RISC-V RINTC fault reproduced; the early check prevents it.
  9       The malformed RINTC is rejected in acpi_init_rintc_map().
  19      LoongArch LPC-PIC over-read observed with instrumentation.
  20      Included in the complete RINTC fix; the boot stops at the
          existing fail-closed BUG before irqchip probing reaches it.
  1-6,
  8,
  10-18 No dynamic claim.  The required GICv5, AVEC, redirect-int,
          HTVEC, and related controller models are not available in the
          QEMU configurations used for this test.

All twenty patches were checked with scripts/checkpatch.pl and were
applied both individually where independent and as the complete series
to the base commit below.

Changes in v2:
- Combine and supersede the six-patch irqchip series [1], the two-patch
  RISC-V series [2], and the remaining MADT checks.
- Add the RISC-V QEMU/EDK2 truncated-RINTC reproduction and fixed-kernel
  result.
- Retain the setup_smp() RINTC fix: testing showed that the later RISC-V
  checks alone do not prevent the early boot fault.
- Document the LoongArch LPC-PIC instrumentation result and the QEMU
  hardware-model limitations for the other callbacks.
- Rebase on the current tree and keep Fixes and stable trailers on every
  patch.

[1] https://lore.kernel.org/r/20261021144524.364143-1-yaojiale02@163.com
[2] https://lore.kernel.org/r/20261016141249.2791819-1-yaojiale02@163.com

Jiale Yao (20):
  ACPI: irqchip: validate MADT entry bounds before probing
  irqchip/gic-v3-its: validate MADT ITS entries
  irqchip/gic-v3: validate MADT records before use
  irqchip/gic-v5-its: validate MADT translate frames
  irqchip/loongarch-cpu: validate MADT LIO-PIC entries
  irqchip/loongson-eiointc: validate MADT BIO-PIC entries
  riscv: validate RINTC entries before use
  ACPI: riscv: validate interrupt controller MADT entries
  riscv: acpi: validate RINTC entries before use
  irqchip/gic-v5-irs: validate MADT GICC entries
  irqchip/gic-v5-irs: validate MADT IRS entries
  irqchip/gic-v5: validate MADT IRS records
  irqchip/gic: validate MADT distributor records
  irqchip/loongarch-avec: validate MADT MSI-PIC entries
  irqchip/loongarch-ir: validate MADT MSI-PIC entries
  irqchip/loongson-htvec: validate MADT BIO-PIC entries
  irqchip/loongson-htvec: validate MADT MSI-PIC entries
  irqchip/loongson-liointc: validate MADT HT-PIC entries
  irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
  irqchip/riscv-intc: validate MADT RINTC entries

 arch/riscv/kernel/acpi.c               |  3 +++
 arch/riscv/kernel/smpboot.c            |  6 +++---
 drivers/acpi/riscv/irq.c               |  6 ++++++
 drivers/acpi/scan.c                    |  7 +++++++
 drivers/irqchip/irq-gic-v3-its.c       |  3 +++
 drivers/irqchip/irq-gic-v3.c           | 15 +++++++++++++++
 drivers/irqchip/irq-gic-v5-irs.c       |  6 ++++++
 drivers/irqchip/irq-gic-v5-its.c       |  3 +++
 drivers/irqchip/irq-gic-v5.c           |  3 +++
 drivers/irqchip/irq-gic.c              |  3 +++
 drivers/irqchip/irq-loongarch-avec.c   |  3 +++
 drivers/irqchip/irq-loongarch-cpu.c    |  3 +++
 drivers/irqchip/irq-loongarch-ir.c     |  3 +++
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 drivers/irqchip/irq-loongson-htvec.c   |  6 ++++++
 drivers/irqchip/irq-loongson-liointc.c |  3 +++
 drivers/irqchip/irq-loongson-pch-pic.c |  3 +++
 drivers/irqchip/irq-riscv-intc.c       |  5 ++++-
 18 files changed, 85 insertions(+), 6 deletions(-)

base-commit: 65ba8f34ec886ec72b2c07ddc8cf3d815c32869d
-- 
2.34.1

[PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Jiale Yao]

IRQ chip probing invokes validation and probe callbacks after the common
table walker has only established that a generic subtable header is
readable. A malformed length can leave callback field accesses outside
the MADT.

Validate the generic header length and ensure the complete declared
entry is contained in the table before invoking IRQ chip callbacks.

Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/scan.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 0b17a7e51956..10e8d736f44b 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
 static int __init acpi_match_madt(union acpi_subtable_headers *header,
 				  const unsigned long end)
 {
+	unsigned long start = (unsigned long)header;
+
+	if (start >= end || end - start < sizeof(header->common) ||
+	    header->common.length < sizeof(header->common) ||
+	    header->common.length > end - start)
+		return -EINVAL;
+
 	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
 		if (!ape->probe_subtbl(header, end))
 			acpi_probe_count++;
-- 
2.34.1

Re: [PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Lorenzo Pieralisi]

On Thu, Oct 29, 2026 at 11:52:32AM +0800, Jiale Yao wrote:
> IRQ chip probing invokes validation and probe callbacks after the common
> table walker has only established that a generic subtable header is
> readable. A malformed length can leave callback field accesses outside
> the MADT.
> 
> Validate the generic header length and ensure the complete declared
> entry is contained in the table before invoking IRQ chip callbacks.
> 
> Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
> Cc: stable@vger.kernel.org

I don't think this patch fixes anything (actually you don't know, it
might break kernels that are currently booting).

Remove the stable tag (on the whole series, though others might have a
different opinion). If this gets merged, goes to stable and then
we discover it triggers a regression (on existing platforms whose
ACPI tables are broken but the system is working) it would be very
annoying.

> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/acpi/scan.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> index 0b17a7e51956..10e8d736f44b 100644
> --- a/drivers/acpi/scan.c
> +++ b/drivers/acpi/scan.c
> @@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
>  static int __init acpi_match_madt(union acpi_subtable_headers *header,
>  				  const unsigned long end)
>  {
> +	unsigned long start = (unsigned long)header;
> +
> +	if (start >= end || end - start < sizeof(header->common) ||
> +	    header->common.length < sizeof(header->common) ||
> +	    header->common.length > end - start)
> +		return -EINVAL;

This is a check that AFAICS could be done in acpi_parse_entries_array() once
for all (where you also know header->common is what you need checking, btw). 

Actually, what's missing there to avoid peppering the kernel with
BAD_MADT_ENTRY checks is the entry size (that we could add with a LUT).

The downsize is that by centralizing it, if anything breaks (which is
possible) we have to revert it and therefore remove the check for all
consumers.

I don't know. Rafael, all, thoughts on this ?

Thanks,
Lorenzo

> +
>  	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
>  		if (!ape->probe_subtbl(header, end))
>  			acpi_probe_count++;
> -- 
> 2.34.1
> 

Re: [PATCH v2 01/20] ACPI: irqchip: validate MADT entry bounds before probing

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 3:44 PM Lorenzo Pieralisi <lpieralisi@kernel.org> wrote:
>
> On Thu, Oct 29, 2026 at 11:52:32AM +0800, Jiale Yao wrote:
> > IRQ chip probing invokes validation and probe callbacks after the common
> > table walker has only established that a generic subtable header is
> > readable. A malformed length can leave callback field accesses outside
> > the MADT.
> >
> > Validate the generic header length and ensure the complete declared
> > entry is contained in the table before invoking IRQ chip callbacks.
> >
> > Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")
> > Cc: stable@vger.kernel.org
>
> I don't think this patch fixes anything (actually you don't know, it
> might break kernels that are currently booting).
>
> Remove the stable tag (on the whole series, though others might have a
> different opinion). If this gets merged, goes to stable and then
> we discover it triggers a regression (on existing platforms whose
> ACPI tables are broken but the system is working) it would be very
> annoying.
>
> > Signed-off-by: Jiale Yao <yaojiale02@163.com>
> > ---
> >  drivers/acpi/scan.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> > index 0b17a7e51956..10e8d736f44b 100644
> > --- a/drivers/acpi/scan.c
> > +++ b/drivers/acpi/scan.c
> > @@ -2896,6 +2896,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
> >  static int __init acpi_match_madt(union acpi_subtable_headers *header,
> >                                 const unsigned long end)
> >  {
> > +     unsigned long start = (unsigned long)header;
> > +
> > +     if (start >= end || end - start < sizeof(header->common) ||
> > +         header->common.length < sizeof(header->common) ||
> > +         header->common.length > end - start)
> > +             return -EINVAL;
>
> This is a check that AFAICS could be done in acpi_parse_entries_array() once
> for all (where you also know header->common is what you need checking, btw).
>
> Actually, what's missing there to avoid peppering the kernel with
> BAD_MADT_ENTRY checks is the entry size (that we could add with a LUT).
>
> The downsize is that by centralizing it, if anything breaks (which is
> possible) we have to revert it and therefore remove the check for all
> consumers.
>
> I don't know. Rafael, all, thoughts on this ?

I have concerns similar to yours: It may break systems that currently boot.

That said, I can imagine a hostile host trying to crash a CoCo guest
by exploiting this missing check.

It might be better to try to use the actual length instead of
header->common.length if the latter is too large though.

[PATCH v2 02/20] irqchip/gic-v3-its: validate MADT ITS entries

[Jiale Yao]

The MADT ITS callback reads the translator base address and ID without
checking that firmware supplied a complete generic translator record. A
truncated entry can therefore cause out-of-bounds reads.

Reject incomplete ITS entries before accessing their typed fields.

Fixes: 3f010cf19732 ("irqchip/gicv3-its: Probe ITS in the ACPI way")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 282e4bafb084..8af88eca14c2 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5736,6 +5736,9 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
 	int err;
 
 	its_entry = (struct acpi_madt_generic_translator *)header;
+	if (BAD_MADT_ENTRY(its_entry, end))
+		return -EINVAL;
+
 	memset(&res, 0, sizeof(res));
 	res.start = its_entry->base_address;
 	res.end = its_entry->base_address + ACPI_GICV3_ITS_MEM_SIZE - 1;
-- 
2.34.1

[PATCH v2 03/20] irqchip/gic-v3: validate MADT records before use

[Jiale Yao]

The GICv3 ACPI paths cast generic MADT headers to distributor,
redistributor, and CPU interface records before confirming that the
required fields are present. Truncated records can therefore cause
out-of-bounds field reads while probing or setting up virtualization data.

Validate fixed-size distributor and redistributor records before their
first field access. Use the version-aware GICC minimum size for CPU
interface records so valid entries from older ACPI revisions remain
accepted. Validate the distributor in the version callback, which runs
before the probe callback uses the same record.

Fixes: ffa7d6166a96 ("irqchip/gic-v3: Add ACPI support for GICv3/4 initialization")
Fixes: b70fb7af6715 ("irqchip/gic-v3: ACPI: Add redistributor support via GICC structures")
Fixes: 1839e576968f ("irqchip/gic-v3: Parse and export virtual GIC information")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v3.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 94873646d46f..3d10818593df 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -2301,6 +2301,9 @@ gic_acpi_parse_madt_redist(union acpi_subtable_headers *header,
 			(struct acpi_madt_generic_redistributor *)header;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_ENTRY(redist, end))
+		return -EINVAL;
+
 	redist_base = ioremap(redist->base_address, redist->length);
 	if (!redist_base) {
 		pr_err("Couldn't map GICR region @%llx\n", redist->base_address);
@@ -2327,6 +2330,9 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header,
 	u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
 	void __iomem *redist_base;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/* Neither enabled or online capable means it doesn't exist, skip it */
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
@@ -2404,6 +2410,9 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc =
 				(struct acpi_madt_generic_interrupt *)header;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	/*
 	 * If GICC is enabled and has valid gicr base address, then it means
 	 * GICR base is presented via GICC. The redistributor is only known to
@@ -2450,6 +2459,9 @@ static bool __init acpi_validate_gic_table(struct acpi_subtable_header *header,
 	int count;
 
 	dist = (struct acpi_madt_generic_distributor *)header;
+	if (BAD_MADT_ENTRY(dist, (unsigned long)header + header->length))
+		return false;
+
 	if (dist->version != ape->driver_data)
 		return false;
 
@@ -2469,6 +2481,9 @@ static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *hea
 		(struct acpi_madt_generic_interrupt *)header;
 	static int first_madt = true;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags &
 	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
-- 
2.34.1

[PATCH v2 04/20] irqchip/gic-v5-its: validate MADT translate frames

[Jiale Yao]

The GICv5 ITS translate-frame callback accesses IDs and the base address
without checking that the MADT entry contains the complete fixed-size
record. A truncated firmware entry can therefore cause out-of-bounds
reads.

Reject incomplete translate-frame entries before using their fields.

Fixes: a97efa5ba594 ("irqchip/gic-v5: Add ACPI ITS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 28e39b065de0..dad3b95ba150 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1233,6 +1233,9 @@ static int __init gic_acpi_parse_madt_its_translate(union acpi_subtable_headers
 	int err;
 
 	its_frame = (struct acpi_madt_gicv5_translate_frame *)header;
+	if (BAD_MADT_ENTRY(its_frame, end))
+		return -EINVAL;
+
 	if (its_frame->linked_translator_id != current_its_entry->translator_id)
 		return 0;
 
-- 
2.34.1

[PATCH v2 05/20] irqchip/loongarch-cpu: validate MADT LIO-PIC entries

[Jiale Yao]

The LIO-PIC MADT callback passes a typed record to the controller
initialization code without checking that the complete record is
present. A truncated firmware entry can therefore lead to out-of-bounds
field reads.

Reject incomplete LIO-PIC entries before passing them to the
initialization helper.

Fixes: b2d3e3354e2a ("irqchip: Add LoongArch CPU interrupt controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongarch-cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-loongarch-cpu.c b/drivers/irqchip/irq-loongarch-cpu.c
index 84ce24889488..6185825477f4 100644
--- a/drivers/irqchip/irq-loongarch-cpu.c
+++ b/drivers/irqchip/irq-loongarch-cpu.c
@@ -119,6 +119,9 @@ static int __init liointc_parse_madt(union acpi_subtable_headers *header,
 {
 	struct acpi_madt_lio_pic *liointc_entry = (struct acpi_madt_lio_pic *)header;
 
+	if (BAD_MADT_ENTRY(liointc_entry, end))
+		return -EINVAL;
+
 	return liointc_acpi_init(irq_domain, liointc_entry);
 }
 
-- 
2.34.1

[PATCH v2 06/20] irqchip/loongson-eiointc: validate MADT BIO-PIC entries

[Jiale Yao]

The BIO-PIC MADT callback reads the controller address before checking
that firmware supplied the complete fixed-size record. A truncated entry
can therefore cause an out-of-bounds read while selecting the parent
domain.

Validate the BIO-PIC record before accessing its address or passing it
to the initialization helper.

Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
index ba6e8480e383..1b90edef5a52 100644
--- a/drivers/irqchip/irq-loongson-eiointc.c
+++ b/drivers/irqchip/irq-loongson-eiointc.c
@@ -454,8 +454,14 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
 					const unsigned long end)
 {
 	struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
-	unsigned int node = pa_to_nid(pchpic_entry->address) & 0xf;
-	struct irq_domain *parent = acpi_get_vec_parent(node, pch_group);
+	struct irq_domain *parent;
+	unsigned int node;
+
+	if (BAD_MADT_ENTRY(pchpic_entry, end))
+		return -EINVAL;
+
+	node = pa_to_nid(pchpic_entry->address) & 0xf;
+	parent = acpi_get_vec_parent(node, pch_group);
 
 	if (parent)
 		return pch_pic_acpi_init(parent, pchpic_entry);
-- 
2.34.1

[PATCH v2 07/20] riscv: validate RINTC entries before use

[Jiale Yao]

The RINTC parser reads the flags field before checking that the MADT
entry contains a complete RINTC structure. A truncated firmware record
can therefore trigger an out-of-bounds read during early CPU discovery.

Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
access.

Fixes: ce92546cd637 ("RISC-V: smpboot: Add ACPI support in setup_smp()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/smpboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index a9de2dae804c..9c341398058c 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	static bool found_boot_cpu;
 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
 
+	if (BAD_MADT_ENTRY(processor, end))
+		return -EINVAL;
+
 	/*
 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
 	 * bit in the flag is not enabled, it means OS should not try to enable
@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	if (!(processor->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-	if (BAD_MADT_ENTRY(processor, end))
-		return -EINVAL;
-
 	acpi_table_print_madt_entry(&header->common);
 
 	hart = processor->hart_id;
-- 
2.34.1

[PATCH v2 08/20] ACPI: riscv: validate interrupt controller MADT entries

[Jiale Yao]

The PLIC and APLIC MADT callbacks cast generic subtable headers to
fixed-size records before checking that the complete records are
present. Truncated firmware entries can therefore cause out-of-bounds
field reads.

Reject entries that do not contain the complete controller-specific
structure before registering an interrupt controller.

Fixes: e77b8dc02a1c ("ACPI: RISC-V: Initialize GSI mapping structures")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/riscv/irq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index da2c42e0ebfd..1f6fee5c5746 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -220,6 +220,9 @@ static int __init riscv_acpi_aplic_parse_madt(union acpi_subtable_headers *heade
 {
 	struct acpi_madt_aplic *aplic = (struct acpi_madt_aplic *)header;
 
+	if (BAD_MADT_ENTRY(aplic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(aplic->gsi_base, aplic->num_sources, aplic->num_idcs,
 					    aplic->id, ACPI_RISCV_IRQCHIP_APLIC);
 }
@@ -229,6 +232,9 @@ static int __init riscv_acpi_plic_parse_madt(union acpi_subtable_headers *header
 {
 	struct acpi_madt_plic *plic = (struct acpi_madt_plic *)header;
 
+	if (BAD_MADT_ENTRY(plic, end))
+		return -EINVAL;
+
 	return riscv_acpi_register_ext_intc(plic->gsi_base, plic->num_irqs, 0,
 					    plic->id, ACPI_RISCV_IRQCHIP_PLIC);
 }
-- 
2.34.1

[PATCH v2 09/20] riscv: acpi: validate RINTC entries before use

[Jiale Yao]

The RINTC callback reads flags and other fields from a typed MADT record
without checking that the complete record is present. A truncated
firmware entry can therefore cause out-of-bounds reads during CPU map
initialization.

Reject incomplete RINTC entries before accessing typed fields.

Fixes: f99561199470 ("RISC-V: ACPI: Cache and retrieve the RINTC structure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/riscv/kernel/acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/acpi.c b/arch/riscv/kernel/acpi.c
index efd52a5d05b5..9e0658c6a869 100644
--- a/arch/riscv/kernel/acpi.c
+++ b/arch/riscv/kernel/acpi.c
@@ -171,6 +171,9 @@ static int acpi_parse_madt_rintc(union acpi_subtable_headers *header, const unsi
 	struct acpi_madt_rintc *rintc = (struct acpi_madt_rintc *)header;
 	int cpuid;
 
+	if (BAD_MADT_ENTRY(rintc, end))
+		return -EINVAL;
+
 	if (!(rintc->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-- 
2.34.1

[PATCH v2 10/20] irqchip/gic-v5-irs: validate MADT GICC entries

[Jiale Yao]

The IAFFID parser reads fields from a typed GICC record without checking
that the MADT entry contains the fields it accesses. Reject truncated
entries before reading them.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/irqchip/irq-gic-v5-irs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 9d60f474aa4f..4e60a1caaba5 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -891,6 +891,9 @@ static int __init gic_acpi_parse_iaffid(union acpi_subtable_headers *header,
 	struct acpi_madt_generic_interrupt *gicc = (struct acpi_madt_generic_interrupt *)header;
 	int cpu;
 
+	if (BAD_MADT_GICC_ENTRY(gicc, end))
+		return -EINVAL;
+
 	if (!(gicc->flags & (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
 		return 0;
 
-- 
2.34.1

Re: [PATCH v2 00/20] ACPI/irqchip: validate MADT entries before use

[Huacai Chen]

Hi, Jiale,

Why can't I see a full list of all Loongson-specific patches in
https://lore.kernel.org/loongarch/ ?

Huacai

On Thu, Oct 29, 2026 at 11:53 AM Jiale Yao <yaojiale02@163.com> wrote:
>
> ACPI interrupt-controller setup passes firmware-supplied MADT subtables
> to architecture and irqchip callbacks.  The common table walker only
> guarantees that a generic subtable header is readable.  A number of
> callbacks cast that header to a larger controller-specific structure and
> read typed fields before checking that the complete record is present.
> Truncated records can therefore cause out-of-bounds reads during early
> CPU and interrupt-controller discovery.
>
> This series combines the previously posted generic/irqchip series [1],
> the RISC-V series [2], and the remaining MADT callback checks into one
> set.  The common irqchip probe path first rejects entries whose declared
> range leaves the table.  Each parser then validates the minimum size of
> the concrete record before its first typed access.
>
> Testing
> =======
>
> The RISC-V cases were tested with qemu-system-riscv64, EDK2 pflash
> firmware, a KASAN-enabled kernel, CONFIG_ACPI_TABLE_UPGRADE=y, and an
> uncompressed initramfs containing an overriding MADT.  The malformed
> table is one page long and ends with a three-byte RINTC entry, while a
> complete struct acpi_madt_rintc is 36 bytes.
>
> On an unpatched kernel the override was accepted and setup_smp() faulted
> in acpi_parse_rintc() while reading processor->flags four bytes from the
> start of the truncated record.  The record starts three bytes before the
> end of the mapped page, so that read entered the following unmapped page:
>
>   Unable to handle kernel paging request
>   epc : acpi_parse_rintc+0x46/0x206
>   cause: 000000000000000d
>   Kernel panic - not syncing: Attempted to kill the idle task!
>
> Applying only the old arch/riscv/kernel/acpi.c and
> drivers/irqchip/irq-riscv-intc.c checks produced the same fault because
> the setup_smp() parser runs first.  With patch 7 moving the existing
> BAD_MADT_ENTRY() check before the flags read, plus patches 9 and 20, the
> out-of-bounds access disappeared.  The malformed table was rejected and
> the kernel later stopped at the existing acpi_init_rintc_map() BUG for a
> machine with no valid RINTC entries.  This is the current fail-closed
> behavior; it is not an out-of-bounds access.
>
> The LoongArch LPC-PIC case was exercised with an overriding MADT ending
> in a three-byte LPC-PIC entry.  Temporary diagnostic instrumentation in
> pch_lpc_parse_madt() reported:
>
>   decl_len=3 sizeof=14 beyond_end=11
>
> This confirms the field accesses covered by patch 19 extend eleven bytes
> beyond the supplied record.  LoongArch maps this early table directly,
> so the read did not itself cause a page fault.
>
> Dynamic test coverage by patch is therefore:
>
>   7       RISC-V RINTC fault reproduced; the early check prevents it.
>   9       The malformed RINTC is rejected in acpi_init_rintc_map().
>   19      LoongArch LPC-PIC over-read observed with instrumentation.
>   20      Included in the complete RINTC fix; the boot stops at the
>           existing fail-closed BUG before irqchip probing reaches it.
>   1-6,
>   8,
>   10-18 No dynamic claim.  The required GICv5, AVEC, redirect-int,
>           HTVEC, and related controller models are not available in the
>           QEMU configurations used for this test.
>
> All twenty patches were checked with scripts/checkpatch.pl and were
> applied both individually where independent and as the complete series
> to the base commit below.
>
> Changes in v2:
> - Combine and supersede the six-patch irqchip series [1], the two-patch
>   RISC-V series [2], and the remaining MADT checks.
> - Add the RISC-V QEMU/EDK2 truncated-RINTC reproduction and fixed-kernel
>   result.
> - Retain the setup_smp() RINTC fix: testing showed that the later RISC-V
>   checks alone do not prevent the early boot fault.
> - Document the LoongArch LPC-PIC instrumentation result and the QEMU
>   hardware-model limitations for the other callbacks.
> - Rebase on the current tree and keep Fixes and stable trailers on every
>   patch.
>
> [1] https://lore.kernel.org/r/20261021144524.364143-1-yaojiale02@163.com
> [2] https://lore.kernel.org/r/20261016141249.2791819-1-yaojiale02@163.com
>
> Jiale Yao (20):
>   ACPI: irqchip: validate MADT entry bounds before probing
>   irqchip/gic-v3-its: validate MADT ITS entries
>   irqchip/gic-v3: validate MADT records before use
>   irqchip/gic-v5-its: validate MADT translate frames
>   irqchip/loongarch-cpu: validate MADT LIO-PIC entries
>   irqchip/loongson-eiointc: validate MADT BIO-PIC entries
>   riscv: validate RINTC entries before use
>   ACPI: riscv: validate interrupt controller MADT entries
>   riscv: acpi: validate RINTC entries before use
>   irqchip/gic-v5-irs: validate MADT GICC entries
>   irqchip/gic-v5-irs: validate MADT IRS entries
>   irqchip/gic-v5: validate MADT IRS records
>   irqchip/gic: validate MADT distributor records
>   irqchip/loongarch-avec: validate MADT MSI-PIC entries
>   irqchip/loongarch-ir: validate MADT MSI-PIC entries
>   irqchip/loongson-htvec: validate MADT BIO-PIC entries
>   irqchip/loongson-htvec: validate MADT MSI-PIC entries
>   irqchip/loongson-liointc: validate MADT HT-PIC entries
>   irqchip/loongson-pch-pic: validate MADT LPC-PIC entries
>   irqchip/riscv-intc: validate MADT RINTC entries
>
>  arch/riscv/kernel/acpi.c               |  3 +++
>  arch/riscv/kernel/smpboot.c            |  6 +++---
>  drivers/acpi/riscv/irq.c               |  6 ++++++
>  drivers/acpi/scan.c                    |  7 +++++++
>  drivers/irqchip/irq-gic-v3-its.c       |  3 +++
>  drivers/irqchip/irq-gic-v3.c           | 15 +++++++++++++++
>  drivers/irqchip/irq-gic-v5-irs.c       |  6 ++++++
>  drivers/irqchip/irq-gic-v5-its.c       |  3 +++
>  drivers/irqchip/irq-gic-v5.c           |  3 +++
>  drivers/irqchip/irq-gic.c              |  3 +++
>  drivers/irqchip/irq-loongarch-avec.c   |  3 +++
>  drivers/irqchip/irq-loongarch-cpu.c    |  3 +++
>  drivers/irqchip/irq-loongarch-ir.c     |  3 +++
>  drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
>  drivers/irqchip/irq-loongson-htvec.c   |  6 ++++++
>  drivers/irqchip/irq-loongson-liointc.c |  3 +++
>  drivers/irqchip/irq-loongson-pch-pic.c |  3 +++
>  drivers/irqchip/irq-riscv-intc.c       |  5 ++++-
>  18 files changed, 85 insertions(+), 6 deletions(-)
>
> base-commit: 65ba8f34ec886ec72b2c07ddc8cf3d815c32869d
> --
> 2.34.1
>