From: Pengpeng Hou <pengpeng@iscas.ac.cn> stable inclusion from stable-v6.6.148 commit 1e31d2394e0db69541b1591d46c5ad6431c81db3 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit fb80117fddb5b477218dc99bb53911b72c3847f8 ] The ivrs_acpihid command-line parser appends entries to a fixed four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before incrementing the map size. Check the capacity at the common found label before parsing the HID and UID or writing the entry. Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Hulk Robot <hulkrobot@huawei.com> Conflicts: drivers/iommu/amd_iommu_init.c drivers/iommu/amd/init.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20@huawei.com> --- drivers/iommu/amd_iommu_init.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c index 9903fd400eb2..7b2757e64c3a 100644 --- a/drivers/iommu/amd_iommu_init.c +++ b/drivers/iommu/amd_iommu_init.c @@ -2964,6 +2964,12 @@ static int __init parse_ivrs_acpihid(char *str) return 1; } + if (early_acpihid_map_size == EARLY_MAP_SIZE) { + pr_err("AMD-Vi: Early ACPI HID map overflow - ignoring ivrs_acpihid%s\n", + str); + return 1; + } + i = early_acpihid_map_size++; memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -- 2.22.0