Re: [PATCH v2 5/6] irqchip/loongarch-cpu: validate MADT LIO-PIC entries

[Huacai Chen]

Hi, Jiale,

On Wed, Oct 21, 2026 at 10:45 PM Jiale Yao <yaojiale02@xxxxxxx> wrote:
>
> The LIO-PIC MADT callback passes a typed record to the controller
> initialization code without checking that the complete record is
> present. A truncated firmware entry can therefore lead to out-of-bounds
> field reads.
>
> Reject incomplete LIO-PIC entries before passing them to the
> initialization helper.
>
> Fixes: b2d3e3354e2a ("irqchip: Add LoongArch CPU interrupt controller support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  drivers/irqchip/irq-loongarch-cpu.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/irqchip/irq-loongarch-cpu.c b/drivers/irqchip/irq-loongarch-cpu.c
> index 84ce24889488..6185825477f4 100644
> --- a/drivers/irqchip/irq-loongarch-cpu.c
> +++ b/drivers/irqchip/irq-loongarch-cpu.c
> @@ -119,6 +119,9 @@ static int __init liointc_parse_madt(union acpi_subtable_headers *header,
>  {
>         struct acpi_madt_lio_pic *liointc_entry = (struct acpi_madt_lio_pic *)header;
>
> +       if (BAD_MADT_ENTRY(liointc_entry, end))
> +               return -EINVAL;
If the madt entry is invalid, the control flow probably cannot arrive
here. On the other hand, All loongson-specific drivers, such as
irq-loongarch-cpu.c, irq-loongarch-avec.c, irq-loongarch-ir.c,
irq-loongson-liointc.c, irq-loongson-eiointc.c, irq-loongson-htvec.c,
irq-loongson-pch-pic.c, use the same logic. Why is this one special?

Huacai
> +
>         return liointc_acpi_init(irq_domain, liointc_entry);
>  }
>
> --
> 2.34.1
>