[PATCH v2 0/6] irqchip: validate ACPI MADT entries before use

[Jiale Yao]

IRQ chip ACPI probing receives MADT records supplied by firmware. The
common probe path does not currently verify that the complete declared
entry is contained in the table, and several callbacks access fixed-size
or version-dependent records without checking their minimum size.
Malformed entries can therefore cause out-of-bounds reads during early
boot.

Add the common declared-range check first, then validate the concrete ITS,
GIC, LIO-PIC, and BIO-PIC records in their respective callbacks. Each patch
remains independently buildable and limits its changes to one parser
implementation.

The series was checked with scripts/checkpatch.pl. Each patch was also
checked individually and in series for application to the base commit
below.

Jiale Yao (6):
  ACPI: irqchip: validate MADT entry bounds before probing
  irqchip/gic-v3-its: validate MADT ITS entries
  irqchip/gic-v3: validate MADT records before use
  irqchip/gic-v5-its: validate MADT translate frames
  irqchip/loongarch-cpu: validate MADT LIO-PIC entries
  irqchip/loongson-eiointc: validate MADT BIO-PIC entries

---
Changes in v2:
- Use BAD_MADT_GICC_ENTRY() for version-dependent GICC records.
- Replace the open-coded distributor size check with BAD_MADT_ENTRY().
- Remove the redundant distributor check from gic_acpi_init().
- Add Fixes and Cc: stable at vger.kernel.org trailers.
- Rebase the series on the current tree.

 drivers/acpi/scan.c                    |  7 +++++++
 drivers/irqchip/irq-gic-v3-its.c       |  3 +++
 drivers/irqchip/irq-gic-v3.c           | 15 +++++++++++++++
 drivers/irqchip/irq-gic-v5-its.c       |  3 +++
 drivers/irqchip/irq-loongarch-cpu.c    |  3 +++
 drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
 6 files changed, 39 insertions(+), 2 deletions(-)


base-commit: a804c5742bff224d4cb4d25dd383554d598be32b
-- 
2.34.1