Re:[PATCH 2/6] irqchip/gic-v3-its: validate MADT ITS entries

[jiale yao]

At 2026-10-16 22:13:53, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The MADT ITS callback reads the translator base address and ID without
>checking that firmware supplied a complete generic translator record. A
>truncated entry can therefore cause out-of-bounds reads.
>
>Reject incomplete ITS entries before accessing their typed fields.
>

Fixes: 3f010cf19732 ("irqchip/gicv3-its: Probe ITS in the ACPI way")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/irqchip/irq-gic-v3-its.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
>index e9807af23537..485a790e4856 100644
>--- a/drivers/irqchip/irq-gic-v3-its.c
>+++ b/drivers/irqchip/irq-gic-v3-its.c
>@@ -5725,6 +5725,9 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
> 	int err;
> 
> 	its_entry = (struct acpi_madt_generic_translator *)header;
>+	if (BAD_MADT_ENTRY(its_entry, end))
>+		return -EINVAL;
>+
> 	memset(&res, 0, sizeof(res));
> 	res.start = its_entry->base_address;
> 	res.end = its_entry->base_address + ACPI_GICV3_ITS_MEM_SIZE - 1;
>-- 
>2.34.1