From 6aaa3f42e3410ea8e26c857477260159f724cb1d Mon Sep 17 00:00:00 2001 From: Mohamad Raizudeen Date: Thu, 3 Sep 2026 22:16:15 +0530 Subject: [PATCH] PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() In nvme_disable_and_flr(), the PCI bar is mapped using NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes) However, the function later reads the controller status from NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte boundary. This violates the API contract. Fix this by increasing the mapping size to include NVME_REG_CSTS. Also change sizeof(cfg) to sizeof(u32) to make the intent clearer. Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR") Signed-off-by: Mohamad Raizudeen Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260903164615.5744-1-raizudeen.kerneldev@gmail.com --- drivers/pci/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 010822baee34..0256bc15d0d1 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4099,7 +4099,7 @@ static int nvme_disable_and_flr(struct pci_dev *dev, bool probe) if (probe) return 0; - bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg)); + bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(u32)); if (!bar) return -ENOTTY;