iommu/amd: Bound the early ACPI HID map

The ivrs_acpihid command-line parser appends entries to a fixed
four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
parsers, it does not reject a fifth entry before incrementing the map size.

Check the capacity at the common found label before parsing the HID and
UID or writing the entry.

Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Will Deacon <will@kernel.org>

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index e93bcb5eef702b532f8709c2f8cb296242513195..e7d7b4cb9337fca27f3d30639bfc893c2501b994 100644 (file)
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3864,6 +3864,12 @@ not_found:
        return 1;
 
 found:
+       if (early_acpihid_map_size == EARLY_MAP_SIZE) {
+               pr_err("Early ACPI HID map overflow - ignoring ivrs_acpihid%s\n",
+                      str);
+               return 1;
+       }
+
        p = acpiid;
        hid = strsep(&p, ":");
        uid = p;