[PATCH 1/2] riscv: validate RINTC entries before use

[Jiale Yao]

The RINTC parser reads the flags field before checking that the MADT
entry contains a complete RINTC structure. A truncated firmware record
can therefore trigger an out-of-bounds read during early CPU discovery.

Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
access.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 arch/riscv/kernel/smpboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index a9de2dae804c..9c341398058c 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	static bool found_boot_cpu;
 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
 
+	if (BAD_MADT_ENTRY(processor, end))
+		return -EINVAL;
+
 	/*
 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
 	 * bit in the flag is not enabled, it means OS should not try to enable
@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
 	if (!(processor->flags & ACPI_MADT_ENABLED))
 		return 0;
 
-	if (BAD_MADT_ENTRY(processor, end))
-		return -EINVAL;
-
 	acpi_table_print_madt_entry(&header->common);
 
 	hart = processor->hart_id;
-- 
2.34.1