From c6479aac4f877d2c64b0eb3553ddd529423a9074 Mon Sep 17 00:00:00 2001 From: Deepanshu Kartikey Date: Sun, 9 Aug 2026 10:29:46 +0530 Subject: [PATCH] PCI/sysfs: Reject unaligned resource I/O port accesses pci_resource_io() validates that off+count stays within the BAR's range but never checks that the resulting port is aligned to the access size. A pwrite64()/pread64() on a resourceN file with an odd offset and count=2 or count=4 reaches outw()/outl() with a misaligned address. On arm64 this becomes a store/load to a Device-memory mapping (PCI_IOBASE + port), which architecturally requires natural alignment, causing an alignment fault and kernel oops. Reject misaligned accesses before they reach the low-level accessor. Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373 Signed-off-by: Deepanshu Kartikey Signed-off-by: Bjorn Helgaas Tested-by: Rihyeon Kim Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260809045946.15638-1-kartikey406@gmail.com --- drivers/pci/pci-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 1f21856aac8a..6669e9ad5bd3 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -1212,6 +1212,9 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, if (port + count - 1 > pci_resource_end(pdev, bar)) return -EINVAL; + if (!IS_ALIGNED(port, count)) + return -EINVAL; + switch (count) { case 1: if (write)