Re:[PATCH 4/6] irqchip/gic-v5-its: validate MADT translate frames

[jiale yao]

At 2026-10-16 22:13:55, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The GICv5 ITS translate-frame callback accesses IDs and the base address
>without checking that the MADT entry contains the complete fixed-size
>record. A truncated firmware entry can therefore cause out-of-bounds
>reads.
>
>Reject incomplete translate-frame entries before using their fields.
>

Fixes: a97efa5ba594 ("irqchip/gic-v5: Add ACPI ITS probing")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/irqchip/irq-gic-v5-its.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
>index 28e39b065de0..dad3b95ba150 100644
>--- a/drivers/irqchip/irq-gic-v5-its.c
>+++ b/drivers/irqchip/irq-gic-v5-its.c
>@@ -1233,6 +1233,9 @@ static int __init gic_acpi_parse_madt_its_translate(union acpi_subtable_headers
> 	int err;
> 
> 	its_frame = (struct acpi_madt_gicv5_translate_frame *)header;
>+	if (BAD_MADT_ENTRY(its_frame, end))
>+		return -EINVAL;
>+
> 	if (its_frame->linked_translator_id != current_its_entry->translator_id)
> 		return 0;
> 
>-- 
>2.34.1