[PATCH 1/6] ACPI: irqchip: validate MADT entry bounds before probing

[Jiale Yao]

IRQ chip probing invokes validation and probe callbacks after the common
table walker has only established that a generic subtable header is
readable. A malformed length can leave callback field accesses outside
the MADT.

Validate the generic header length and ensure the complete declared
entry is contained in the table before invoking IRQ chip callbacks.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/acpi/scan.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 163a3cccf197..ef8e8441b6ef 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2889,6 +2889,13 @@ static DEFINE_MUTEX(acpi_probe_mutex);
 static int __init acpi_match_madt(union acpi_subtable_headers *header,
 				  const unsigned long end)
 {
+	unsigned long start = (unsigned long)header;
+
+	if (start >= end || end - start < sizeof(header->common) ||
+	    header->common.length < sizeof(header->common) ||
+	    header->common.length > end - start)
+		return -EINVAL;
+
 	if (!ape->subtable_valid || ape->subtable_valid(&header->common, ape))
 		if (!ape->probe_subtbl(header, end))
 			acpi_probe_count++;
-- 
2.34.1