[PATCH 2/2] ACPI: riscv: validate interrupt controller MADT entries

[jiale yao]

At 2026-10-16 22:12:48, "Jiale Yao" <yaojiale02 at 163.com> wrote:
>The PLIC and APLIC MADT callbacks cast generic subtable headers to
>fixed-size records before checking that the complete records are
>present. Truncated firmware entries can therefore cause out-of-bounds
>field reads.
>
>Reject entries that do not contain the complete controller-specific
>structure before registering an interrupt controller.
>

Fixes: e77b8dc02a1c ("ACPI: RISC-V: Initialize GSI mapping structures")

>Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
>---
> drivers/acpi/riscv/irq.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
>index da2c42e0ebfd..1f6fee5c5746 100644
>--- a/drivers/acpi/riscv/irq.c
>+++ b/drivers/acpi/riscv/irq.c
>@@ -220,6 +220,9 @@ static int __init riscv_acpi_aplic_parse_madt(union acpi_subtable_headers *heade
> {
> 	struct acpi_madt_aplic *aplic = (struct acpi_madt_aplic *)header;
> 
>+	if (BAD_MADT_ENTRY(aplic, end))
>+		return -EINVAL;
>+
> 	return riscv_acpi_register_ext_intc(aplic->gsi_base, aplic->num_sources, aplic->num_idcs,
> 					    aplic->id, ACPI_RISCV_IRQCHIP_APLIC);
> }
>@@ -229,6 +232,9 @@ static int __init riscv_acpi_plic_parse_madt(union acpi_subtable_headers *header
> {
> 	struct acpi_madt_plic *plic = (struct acpi_madt_plic *)header;
> 
>+	if (BAD_MADT_ENTRY(plic, end))
>+		return -EINVAL;
>+
> 	return riscv_acpi_register_ext_intc(plic->gsi_base, plic->num_irqs, 0,
> 					    plic->id, ACPI_RISCV_IRQCHIP_PLIC);
> }
>-- 
>2.34.1