[PATCH 12/12] irqchip/riscv-intc: validate MADT RINTC entries

[Jiale Yao]

The ACPI initialization callback copies fields from a typed RINTC record
without checking that the complete record is present. Reject truncated
entries before allocating or reading per-controller data.

Fixes: 7023b9d83f03 ("irqchip/riscv-intc: Add ACPI support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/irqchip/irq-riscv-intc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c
index 0595144116e2..6884fa413df0 100644
--- a/drivers/irqchip/irq-riscv-intc.c
+++ b/drivers/irqchip/irq-riscv-intc.c
@@ -344,6 +344,10 @@ static int __init riscv_intc_acpi_init(union acpi_subtable_headers *header,
 	int count;
 	int rc;
 
+	rintc = (struct acpi_madt_rintc *)header;
+	if (BAD_MADT_ENTRY(rintc, end))
+		return -EINVAL;
+
 	if (!rintc_acpi_data) {
 		count = acpi_table_parse_madt(ACPI_MADT_TYPE_RINTC, riscv_intc_acpi_match, 0);
 		if (count <= 0)
@@ -354,7 +358,6 @@ static int __init riscv_intc_acpi_init(union acpi_subtable_headers *header,
 			return -ENOMEM;
 	}
 
-	rintc = (struct acpi_madt_rintc *)header;
 	rintc_acpi_data[nr_rintc] = kzalloc_obj(*rintc_acpi_data[0]);
 	if (!rintc_acpi_data[nr_rintc])
 		return -ENOMEM;
-- 
2.34.1