[PATCH 05/12] irqchip/gic: validate MADT distributor records

[Jiale Yao]

The ACPI probe validator reads the version from a typed distributor
record without first establishing its size. The accepted record is then
passed to the initialization callback, which reads its base address.

Reject incomplete distributor records in the validator before either
callback accesses typed fields.

Fixes: d60fc3892c4de ("irqchip: Add GICv2 specific ACPI boot support")
Fixes: f26527b1428f ("irqchip / GIC: Convert the GIC driver to ACPI probing")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/irqchip/irq-gic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index a5ca04e9be64..21fcbfdc2093 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1583,6 +1583,9 @@ static bool __init gic_validate_dist(struct acpi_subtable_header *header,
 	struct acpi_madt_generic_distributor *dist;
 	dist = (struct acpi_madt_generic_distributor *)header;
 
+	if (BAD_MADT_ENTRY(dist, (unsigned long)header + header->length))
+		return false;
+
 	return (dist->version == ape->driver_data &&
 		(dist->version != ACPI_MADT_GIC_VERSION_NONE ||
 		 !acpi_gic_redist_is_present()));
-- 
2.34.1