github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

PCI/sysfs: Reject unaligned resource I/O port accesses

Browse Source 
pci_resource_io() validates that off+count stays within the BAR's range but
never checks that the resulting port is aligned to the access size. A
pwrite64()/pread64() on a resourceN file with an odd offset and count=2 or
count=4 reaches outw()/outl() with a misaligned address. On arm64 this
becomes a store/load to a Device-memory mapping (PCI_IOBASE + port), which
architecturally requires natural alignment, causing an alignment fault and
kernel oops.

Reject misaligned accesses before they reach the low-level accessor.

Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Rihyeon Kim <rihyeon8648@gmail.com>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260809045946.15638-1-kartikey406@gmail.com
This commit is contained in:
Deepanshu Kartikey 2026-08-09 10:29:46 +05:30 committed by Bjorn Helgaas
parent af5ca2d751
commit c6479aac4f
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/pci/pci-sysfs.c
View File

@ -1212,6 +1212,9 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
if (port + count - 1 > pci_resource_end(pdev, bar))
return -EINVAL;
if (!IS_ALIGNED(port, count))
return -EINVAL;
switch (count) {
case 1:
if (write)