diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-20 19:46:13 +0800 |
|---|---|---|
| committer | Will Deacon <will@kernel.org> | 2026-07-21 11:34:46 +0000 |
| commit | fb80117fddb5b477218dc99bb53911b72c3847f8 (patch) | |
| tree | aa3b282217ee7213df45831a0e47a11c75fd2aad | |
| parent | 780dfed688622ea01be3c9c2c55eec2207f05e04 (diff) | |
iommu/amd: Bound the early ACPI HID map
The ivrs_acpihid command-line parser appends entries to a fixed
four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
parsers, it does not reject a fifth entry before incrementing the map size.
Check the capacity at the common found label before parsing the HID and
UID or writing the entry.
Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Will Deacon <will@kernel.org>
| -rw-r--r-- | drivers/iommu/amd/init.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index e93bcb5eef70..e7d7b4cb9337 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3864,6 +3864,12 @@ not_found: return 1; found: + if (early_acpihid_map_size == EARLY_MAP_SIZE) { + pr_err("Early ACPI HID map overflow - ignoring ivrs_acpihid%s\n", + str); + return 1; + } + p = acpiid; hid = strsep(&p, ":"); uid = p; |