Re:[PATCH 1/2] riscv: validate RINTC entries before use

[jiale yao]

At 2026-10-16 22:12:47, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The RINTC parser reads the flags field before checking that the MADT
>entry contains a complete RINTC structure. A truncated firmware record
>can therefore trigger an out-of-bounds read during early CPU discovery.
>
>Move the existing BAD_MADT_ENTRY() check ahead of the first typed field
>access.
>

Fixes: ce92546cd637 ("RISC-V: smpboot: Add ACPI support in setup_smp()")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> arch/riscv/kernel/smpboot.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
>index a9de2dae804c..9c341398058c 100644
>--- a/arch/riscv/kernel/smpboot.c
>+++ b/arch/riscv/kernel/smpboot.c
>@@ -76,6 +76,9 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
> 	static bool found_boot_cpu;
> 	struct acpi_madt_rintc *processor = (struct acpi_madt_rintc *)header;
> 
>+	if (BAD_MADT_ENTRY(processor, end))
>+		return -EINVAL;
>+
> 	/*
> 	 * Each RINTC structure in MADT will have a flag. If ACPI_MADT_ENABLED
> 	 * bit in the flag is not enabled, it means OS should not try to enable
>@@ -84,9 +87,6 @@ static int __init acpi_parse_rintc(union acpi_subtable_headers *header, const un
> 	if (!(processor->flags & ACPI_MADT_ENABLED))
> 		return 0;
> 
>-	if (BAD_MADT_ENTRY(processor, end))
>-		return -EINVAL;
>-
> 	acpi_table_print_madt_entry(&header->common);
> 
> 	hart = processor->hart_id;
>-- 
>2.34.1