The PCC mailbox driver counts PCCT entries before its probe walks the
same records by their declared lengths and passes them to type-specific
parsers.  The counting pass currently accepts entries based only on their
type, so a malformed entry can move the probe cursor outside the table or
cause an out-of-bounds field read.

Validate each entry against the table boundary and the minimum size of
its PCCT subspace type during the initial ACPI parsing pass.  This also
covers Type 5 hardware register communication subspaces before the same
immutable table is consumed by the mailbox probe.

Fixes: 86c22f8c9a3b ("Mailbox: Add support for Platform Communication Channel")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---

Notes:
    Changes in v3:
    - Add the minimum size for Type 5 hardware register communication
      subspaces.
    - Reject unsupported types before indexing the minimum-length table.
    - Drop duplicate validation from pcc_mbox_probe(), since the entries are
      already validated by the initial ACPI parsing pass.
    
    Changes in v2:
    - Replace the type switch with a minimum-length lookup table.
    - Remove the redundant remaining-header-size check.
    - Keep an explicit type bound check before indexing the table.

 drivers/mailbox/pcc.c | 40 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 14dc4a187bfc..5d20c5a6d183 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -560,6 +560,37 @@ static const struct mbox_chan_ops pcc_chan_ops = {
 	.last_tx_done = pcc_last_tx_done,
 };
 
+static const u16 pcc_subspace_min_len[ACPI_PCCT_TYPE_RESERVED] = {
+	[ACPI_PCCT_TYPE_GENERIC_SUBSPACE] =
+		sizeof(struct acpi_pcct_subspace),
+	[ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE] =
+		sizeof(struct acpi_pcct_hw_reduced),
+	[ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2] =
+		sizeof(struct acpi_pcct_hw_reduced_type2),
+	[ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE] =
+		sizeof(struct acpi_pcct_ext_pcc_master),
+	[ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE] =
+		sizeof(struct acpi_pcct_ext_pcc_slave),
+	[ACPI_PCCT_TYPE_HW_REG_COMM_SUBSPACE] =
+		sizeof(struct acpi_pcct_hw_reg),
+};
+
+static bool pcc_subspace_is_valid(struct acpi_subtable_header *entry,
+				  unsigned long end)
+{
+	unsigned long start = (unsigned long)entry;
+	size_t length;
+
+	if (start >= end)
+		return false;
+
+	length = entry->length;
+	if (length < sizeof(*entry) || length > end - start)
+		return false;
+
+	return length >= pcc_subspace_min_len[entry->type];
+}
+
 /**
  * parse_pcc_subspace - Count PCC subspaces defined
  * @header: Pointer to the ACPI subtable header under the PCCT.
@@ -575,10 +606,13 @@ static int parse_pcc_subspace(union acpi_subtable_headers *header,
 {
 	struct acpi_pcct_subspace *ss = (struct acpi_pcct_subspace *) header;
 
-	if (ss->header.type < ACPI_PCCT_TYPE_RESERVED)
-		return 0;
+	if (ss->header.type >= ACPI_PCCT_TYPE_RESERVED)
+		return -EINVAL;
 
-	return -EINVAL;
+	if (!pcc_subspace_is_valid(&ss->header, end))
+		return -EINVAL;
+
+	return 0;
 }
 
 static int
-- 
2.34.1