Re:[PATCH 6/6] irqchip/loongson-eiointc: validate MADT BIO-PIC entries

[jiale yao]

At 2026-10-16 22:13:57, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The BIO-PIC MADT callback reads the controller address before checking
>that firmware supplied the complete fixed-size record. A truncated entry
>can therefore cause an out-of-bounds read while selecting the parent
>domain.
>
>Validate the BIO-PIC record before accessing its address or passing it
>to the initialization helper.
>

Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/irqchip/irq-loongson-eiointc.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
>index a9e8b481d31d..f92e7702195a 100644
>--- a/drivers/irqchip/irq-loongson-eiointc.c
>+++ b/drivers/irqchip/irq-loongson-eiointc.c
>@@ -454,8 +454,14 @@ static int __init pch_pic_parse_madt(union acpi_subtable_headers *header,
> 					const unsigned long end)
> {
> 	struct acpi_madt_bio_pic *pchpic_entry = (struct acpi_madt_bio_pic *)header;
>-	unsigned int node = (pchpic_entry->address >> 44) & 0xf;
>-	struct irq_domain *parent = acpi_get_vec_parent(node, pch_group);
>+	struct irq_domain *parent;
>+	unsigned int node;
>+
>+	if (BAD_MADT_ENTRY(pchpic_entry, end))
>+		return -EINVAL;
>+
>+	node = (pchpic_entry->address >> 44) & 0xf;
>+	parent = acpi_get_vec_parent(node, pch_group);
> 
> 	if (parent)
> 		return pch_pic_acpi_init(parent, pchpic_entry);
>-- 
>2.34.1