Re:[PATCH] mailbox: pcc: validate PCCT subspaces before parsing

[jiale yao]

At 2026-10-16 22:15:30, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The PCC mailbox probe walks PCCT entries by their declared lengths
>without checking that each entry is contained in the table. It also
>passes generic headers to type-specific parsers without establishing the
>required record size. Malformed firmware can therefore move the cursor
>outside the PCCT or cause out-of-bounds field reads.
>
>Validate the table header, each subspace range, and the minimum size for
>supported subspace types during both the counting and probe passes.
>

Fixes: 86c22f8c9a3b ("Mailbox: Add support for Platform Communication Channel")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/mailbox/pcc.c | 53 ++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 52 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
>index 9888dab64639..37b2ddb44bda 100644
>--- a/drivers/mailbox/pcc.c
>+++ b/drivers/mailbox/pcc.c
>@@ -553,6 +553,42 @@ static const struct mbox_chan_ops pcc_chan_ops = {
> 	.last_tx_done = pcc_last_tx_done,
> };
> 
>+static bool pcc_subspace_is_valid(struct acpi_subtable_header *entry,
>+				  unsigned long end)
>+{
>+	unsigned long start = (unsigned long)entry;
>+	size_t length, min_length;
>+
>+	if (start >= end || end - start < sizeof(*entry))
>+		return false;
>+
>+	length = entry->length;
>+	if (length < sizeof(*entry) || length > end - start)
>+		return false;
>+
>+	switch (entry->type) {
>+	case ACPI_PCCT_TYPE_GENERIC_SUBSPACE:
>+		min_length = sizeof(struct acpi_pcct_subspace);
>+		break;
>+	case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE:
>+		min_length = sizeof(struct acpi_pcct_hw_reduced);
>+		break;
>+	case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2:
>+		min_length = sizeof(struct acpi_pcct_hw_reduced_type2);
>+		break;
>+	case ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE:
>+		min_length = sizeof(struct acpi_pcct_ext_pcc_master);
>+		break;
>+	case ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE:
>+		min_length = sizeof(struct acpi_pcct_ext_pcc_slave);
>+		break;
>+	default:
>+		return false;
>+	}
>+
>+	return length >= min_length;
>+}
>+
> /**
>  * parse_pcc_subspace - Count PCC subspaces defined
>  * @header: Pointer to the ACPI subtable header under the PCCT.
>@@ -568,6 +604,9 @@ static int parse_pcc_subspace(union acpi_subtable_headers *header,
> {
> 	struct acpi_pcct_subspace *ss = (struct acpi_pcct_subspace *) header;
> 
>+	if (!pcc_subspace_is_valid(&ss->header, end))
>+		return -EINVAL;
>+
> 	if (ss->header.type < ACPI_PCCT_TYPE_RESERVED)
> 		return 0;
> 
>@@ -812,6 +851,7 @@ static int pcc_mbox_probe(struct platform_device *pdev)
> 	struct acpi_table_header *pcct_tbl;
> 	struct acpi_subtable_header *pcct_entry;
> 	struct acpi_table_pcct *acpi_pcct_tbl;
>+	unsigned long table_end;
> 	acpi_status status = AE_OK;
> 	int i, rc, count = pcc_chan_count;
> 
>@@ -821,6 +861,13 @@ static int pcc_mbox_probe(struct platform_device *pdev)
> 	if (ACPI_FAILURE(status) || !pcct_tbl)
> 		return -ENODEV;
> 
>+	acpi_pcct_tbl = (struct acpi_table_pcct *)pcct_tbl;
>+	if (pcct_tbl->length < sizeof(*acpi_pcct_tbl)) {
>+		rc = -EINVAL;
>+		goto err;
>+	}
>+	table_end = (unsigned long)pcct_tbl + pcct_tbl->length;
>+
> 	pcc_mbox_channels = devm_kcalloc(dev, count, sizeof(*pcc_mbox_channels),
> 					 GFP_KERNEL);
> 	if (!pcc_mbox_channels) {
>@@ -844,7 +891,6 @@ static int pcc_mbox_probe(struct platform_device *pdev)
> 	pcct_entry = (struct acpi_subtable_header *) (
> 		(unsigned long) pcct_tbl + sizeof(struct acpi_table_pcct));
> 
>-	acpi_pcct_tbl = (struct acpi_table_pcct *) pcct_tbl;
> 	if (acpi_pcct_tbl->flags & ACPI_PCCT_DOORBELL) {
> 		pcc_mbox_ctrl->txdone_irq = true;
> 		pcc_mbox_ctrl->txdone_poll = false;
>@@ -856,6 +902,11 @@ static int pcc_mbox_probe(struct platform_device *pdev)
> 	for (i = 0; i < count; i++) {
> 		struct pcc_chan_info *pchan = chan_info + i;
> 
>+		if (!pcc_subspace_is_valid(pcct_entry, table_end)) {
>+			rc = -EINVAL;
>+			goto err;
>+		}
>+
> 		pcc_mbox_channels[i].con_priv = pchan;
> 		pchan->chan.mchan = &pcc_mbox_channels[i];
> 
>-- 
>2.34.1