tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

PCI: Test for bit underflow in pcie_set_readrq()

In preparation for the future commit ("bitops: Add __attribute_const__ to generic
ffs()-family implementations"), which allows GCC's value range tracker
to see past ffs(), GCC 8 on ARM thinks that it might be possible that
"ffs(rq) - 8" used here:

v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);

could wrap below 0, leading to a very large value, which would be out of
range for the FIELD_PREP() usage:

drivers/pci/pci.c: In function 'pcie_set_readrq':
include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field
...
drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP'
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
^~~~~~~~~~

If the result of the ffs() is bounds checked before being used in
FIELD_PREP(), the value tracker seems happy again. :)

Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Closes: https://lore.kernel.org/linux-pci/CA+G9fYuysVr6qT8bjF6f08WLyCJRG7aXAeSd2F7=zTaHHd7L+Q@mail.gmail.com/
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20250905052836.work.425-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>

Kees Cook 00e58ff9 c17b750b

+5 -1
+5 -1
drivers/pci/pci.c
··· 5932 5932 { 5933 5933 u16 v; 5934 5934 int ret; 5935 + unsigned int firstbit; 5935 5936 struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus); 5936 5937 5937 5938 if (rq < 128 || rq > 4096 || !is_power_of_2(rq)) ··· 5950 5949 rq = mps; 5951 5950 } 5952 5951 5953 - v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8); 5952 + firstbit = ffs(rq); 5953 + if (firstbit < 8) 5954 + return -EINVAL; 5955 + v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, firstbit - 8); 5954 5956 5955 5957 if (bridge->no_inc_mrrs) { 5956 5958 int max_mrrs = pcie_get_readrq(dev);