Re:[PATCH 1/6] ACPI: irqchip: validate MADT entry bounds before probing

[jiale yao]

At 2026-10-16 22:13:52, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>IRQ chip probing invokes validation and probe callbacks after the common
>table walker has only established that a generic subtable header is
>readable. A malformed length can leave callback field accesses outside
>the MADT.
>
>Validate the generic header length and ensure the complete declared
>entry is contained in the table before invoking IRQ chip callbacks.
>

Fixes: e647b532275b ("ACPI: Add early device probing infrastructure")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/acpi/scan.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
>diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
>index 163a3cccf197..ef8e8441b6ef 100644
>--- a/drivers/acpi/scan.c
>+++ b/drivers/acpi/scan.c
>@@ -2889,6 +2889,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
> static int __init acpi_match_madt(union acpi_subtable_headers *header,
> 				  const unsigned long end)
> {
>+	unsigned long start = (unsigned long)header;
>+
>+	if (start >= end || end - start < sizeof(header->common) ||
>+	    header->common.length < sizeof(header->common) ||
>+	    header->common.length > end - start)
>+		return -EINVAL;
>+
> 	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
> 		if (!ape->probe_subtbl(header, end))
> 			acpi_probe_count++;
>-- 
>2.34.1