[PATCH] iommu/amd: bound early ACPI HID map entries

[PATCH] iommu/amd: bound early ACPI HID map entries

[Pengpeng Hou]

parse_ivrs_acpihid() appends command-line ACPI HID mappings to the
fixed early_acpihid_map[] array, but unlike the neighbouring IOAPIC
and HPET parsers it does not check early_acpihid_map_size before
incrementing it and writing the next entry.

Reject additional ivrs_acpihid= entries once the fixed early map is
full.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/iommu/amd/init.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3888,6 +3888,11 @@
 		return 1;
 	}
 
+	if (early_acpihid_map_size == EARLY_MAP_SIZE) {
+		pr_err("Invalid command line: too many ivrs_acpihid entries\n");
+		return 1;
+	}
+
 	i = early_acpihid_map_size++;
 	memcpy(early_acpihid_map[i].hid, hid, strlen(hid));
 	memcpy(early_acpihid_map[i].uid, uid, strlen(uid));

Re: [PATCH] iommu/amd: bound early ACPI HID map entries

[Ankit Soni]

On Sat, Jul 04, 2026 at 09:16:01AM +0800, Pengpeng Hou wrote:
> parse_ivrs_acpihid() appends command-line ACPI HID mappings to the
> fixed early_acpihid_map[] array, but unlike the neighbouring IOAPIC
> and HPET parsers it does not check early_acpihid_map_size before
> incrementing it and writing the next entry.
> 
> Reject additional ivrs_acpihid= entries once the fixed early map is
> full.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/iommu/amd/init.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3888,6 +3888,11 @@
>  		return 1;
>  	}
>  
> +	if (early_acpihid_map_size == EARLY_MAP_SIZE) {
> +		pr_err("Invalid command line: too many ivrs_acpihid entries\n");

Hi,
This is not invalid option, the entry may be valid but there is no room
to add it. It should be something like

pr_err("Early IOAPIC map overflow - ignoring ivrs_ioapic%s\n", str);

and this check should be first thing under 'found' lable, before parsing
hid and uid.


-Ankit

> +		return 1;
> +	}
> +
>  	i = early_acpihid_map_size++;
>  	memcpy(early_acpihid_map[i].hid, hid, strlen(hid));
>  	memcpy(early_acpihid_map[i].uid, uid, strlen(uid));
>