[PATCH] iommu/amd: bound early ACPI HID map entries

[Pengpeng Hou]

parse_ivrs_acpihid() appends command-line ACPI HID mappings to the
fixed early_acpihid_map[] array, but unlike the neighbouring IOAPIC
and HPET parsers it does not check early_acpihid_map_size before
incrementing it and writing the next entry.

Reject additional ivrs_acpihid= entries once the fixed early map is
full.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/iommu/amd/init.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3888,6 +3888,11 @@
 		return 1;
 	}
 
+	if (early_acpihid_map_size == EARLY_MAP_SIZE) {
+		pr_err("Invalid command line: too many ivrs_acpihid entries\n");
+		return 1;
+	}
+
 	i = early_acpihid_map_size++;
 	memcpy(early_acpihid_map[i].hid, hid, strlen(hid));
 	memcpy(early_acpihid_map[i].uid, uid, strlen(uid));