Re: [PATCH] ACPI: IORT: validate RMR node array bounds

[Hanjun Guo]

Hi Will,

On 2026/7/31 23:42, Will Deacon wrote:
> On Mon, Jul 06, 2026 at 05:43:00PM +0800, Pengpeng Hou wrote:
> > IORT RMR nodes describe reserved-memory ranges through firmware
> > offset and count fields inside the current IORT node.
> >
> > Validate the generic IORT node length before dispatching it, and
> > check both the RMR descriptor array and the ID mapping array before
> > walking them.  This binds each array walk to the current node length
> > instead of only trusting the firmware-provided count.
> >
> > Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> > ---
> >   drivers/acpi/arm64/iort.c | 83 +++++++++++++++++++++++++++++++++++++--
> >   1 file changed, 79 insertions(+), 4 deletions(-)
>
> Hanjun, Lorenzo, any thoughts on this one?

Thanks for reminding.

In my personal opinion, this is not a real issue because if something
wrong with the IORT, the IORT will not work at booting, for example
the device will map to a wrong ITS or SMMU, the device will not work
at all, so those issues will be fixed at the pre-production stage,
correct me if I'm wrong.

But to the patch itself, it's no harm, I will comment on this patch.

Thanks
Hanjun