Re: [PATCH v5 03/49] irqchip/gic-v5: Set up gic_kvm_info on ACPI hosts

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing bounds check in gic_acpi_parse_virt_madt_gicc() when parsing ACPI MADT GICC subtables, leading to out-of-bounds read on malformed tables.
--

--- Patch [3]: [PATCH v5 03/49] irqchip/gic-v5: Set up gic_kvm_info on ACPI hosts ---
commit 7147e5b6fec39dcd71e533b7ddd5252d309103a5
Author: Sascha Bischoff <[email protected]>

irqchip/gic-v5: Set up gic_kvm_info on ACPI hosts

This commit adds the ACPI equivalent of the DT KVM setup for GICv5. It parses
the MADT GICC entries to retrieve and register the maintenance interrupt, and
passes the resulting IRQ along with IRS base and coherency information to KVM.

> diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
> index e7a7aedcfaf78..5b8ea8551d832 100644
> --- a/drivers/irqchip/irq-gic-v5.c
> +++ b/drivers/irqchip/irq-gic-v5.c
[ ... ]
> @@ -1162,11 +1164,95 @@ static void __init gic_of_setup_kvm_info(struct device_node *node)
[ ... ]
> +static int __init gic_acpi_parse_virt_madt_gicc(union acpi_subtable_headers *header,
> +						const unsigned long end)
> +{
> +	struct acpi_madt_generic_interrupt *gicc =
> +		(struct acpi_madt_generic_interrupt *)header;
> +	static int first_madt = true;
> +
> +	if (!(gicc->flags &

[Severity: High]
Could this read of gicc->flags lead to an out-of-bounds memory access?

If the firmware provides a malformed ACPI MADT table with an entry length
smaller than the size of struct acpi_madt_generic_interrupt, reading
gicc->flags or gicc->vgic_interrupt might cross a page boundary and cause a
kernel panic during early boot.

Would it make sense to validate the entry size against the end pointer here,
perhaps by using a macro like BAD_MADT_GICC_ENTRY(gicc, end), before accessing
any of the structure's fields?

> +	      (ACPI_MADT_ENABLED | ACPI_MADT_GICC_ONLINE_CAPABLE)))
> +		return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3