iommu/amd: bound the early ACPI HID map

[PATCH v2] iommu/amd: bound the early ACPI HID map

Posted by Pengpeng Hou 4 days, 14 hours ago

The ivrs_acpihid command-line parser appends entries to a fixed
four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
parsers, it does not reject a fifth entry before incrementing the map size.

Check the capacity at the common found label before parsing the HID and
UID or writing the entry.

Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260704011601.62087-1-pengpeng@iscas.ac.cn/
- move the capacity check to the start of the found path
- describe the condition as a full map rather than an invalid option
- rebase onto v7.2-rc4

 drivers/iommu/amd/init.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index e93bcb5eef70..e7d7b4cb9337 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3864,6 +3864,12 @@ static int __init parse_ivrs_acpihid(char *str)
 	return 1;
 
 found:
+	if (early_acpihid_map_size == EARLY_MAP_SIZE) {
+		pr_err("Early ACPI HID map overflow - ignoring ivrs_acpihid%s\n",
+		       str);
+		return 1;
+	}
+
 	p = acpiid;
 	hid = strsep(&p, ":");
 	uid = p;

Re: [PATCH v2] iommu/amd: bound the early ACPI HID map

Posted by Will Deacon 3 days, 13 hours ago

On Mon, 20 Jul 2026 19:46:13 +0800, Pengpeng Hou wrote:
> The ivrs_acpihid command-line parser appends entries to a fixed
> four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
> parsers, it does not reject a fifth entry before incrementing the map size.
> 
> Check the capacity at the common found label before parsing the HID and
> UID or writing the entry.
> 
> [...]

Applied to iommu (fixes), thanks!

[1/1] iommu/amd: bound the early ACPI HID map
      https://git.kernel.org/iommu/c/fb80117fddb5

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev

Re: [PATCH v2] iommu/amd: bound the early ACPI HID map

Posted by Ankit Soni 3 days, 20 hours ago

On Mon, Jul 20, 2026 at 07:46:13PM +0800, Pengpeng Hou wrote:
> The ivrs_acpihid command-line parser appends entries to a fixed
> four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
> parsers, it does not reject a fifth entry before incrementing the map size.
> 
> Check the capacity at the common found label before parsing the HID and
> UID or writing the entry.
> 
> Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>

> ---
> Changes since v1: https://lore.kernel.org/all/20260704011601.62087-1-pengpeng@iscas.ac.cn/
> - move the capacity check to the start of the found path
> - describe the condition as a full map rather than an invalid option
> - rebase onto v7.2-rc4
> 
>  drivers/iommu/amd/init.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index e93bcb5eef70..e7d7b4cb9337 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3864,6 +3864,12 @@ static int __init parse_ivrs_acpihid(char *str)
>  	return 1;
>  
>  found:
> +	if (early_acpihid_map_size == EARLY_MAP_SIZE) {
> +		pr_err("Early ACPI HID map overflow - ignoring ivrs_acpihid%s\n",
> +		       str);
> +		return 1;
> +	}
> +
>  	p = acpiid;
>  	hid = strsep(&p, ":");
>  	uid = p;
>