Re: [PATCH] iommu: intel: Apply the device scope length check to every device scope walk

[Baolu Lu]

On 10/12/2026 4:41 PM, Shirong Zhao wrote:
> dmar_walk_remapping_entries() already refuses to step by a zero length:
>
> 	next = (void *)iter + iter->length;
> 	if (iter->length == 0) {
> 		/* Avoid looping forever on bad ACPI tables */
> 		pr_debug(FW_BUG "Invalid 0-length structure\n");
> 		break;
> 	}
>
> Five walks over the same DMAR structures do not:
>
>    dmar_alloc_dev_scope()        - counts namespace/endpoint/bridge scopes
>    dmar_insert_dev_scope()       - attaches a scope to a PCI path
>    dmar_acpi_insert_dev_scope()  - same, by ANDD enumeration id
>    dmar_acpi_dev_scope_init()    - the ANDD entries at the end of the table
>    ir_parse_ioapic_hpet_scope()  - IOAPIC and HPET scopes
>
> Each advances its cursor by a length read out of the DMAR table, and
> nothing constrains it.  A zero length leaves the cursor where it is and
> the walk never ends; a short one steps through table payload a byte at a
> time, reinterpreting it as scopes.  dmar_alloc_dev_scope() and
> dmar_acpi_dev_scope_init() run on every boot with the IOMMU enabled, and a
> short length in the latter hands andd->device_name to acpi_get_handle().
>
> Use the check dmar_walk_remapping_entries() already uses.
>
> Checked against torvalds/linux at HEAD; both files are unmodified there.
>
> Found by EFSM.R17, which reports a loop whose cursor advances by a step
> memory can supply as zero while the exit condition depends on that cursor.
> Signed-off-by: Shirong Zhao<shxzhaosr@xxxxxxx>
>
> ---
>   drivers/iommu/intel/dmar.c          | 16 ++++++++++++++++
>   drivers/iommu/intel/irq_remapping.c |  5 +++++
>   2 files changed, 21 insertions(+)

A zero length is never valid under the VT-d spec, so such a DMAR table
is a firmware bug.

The existing check in dmar_walk_remapping_entries() already rejects a
zero-length top-level structure before any of these walks run, and I'm
not aware of any shipping platform with a malformed device scope.

Without a real-world report, I'd rather not add more checks for this.
Thanks for looking at this, though.

Thanks,
baolu