Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

PCI: Validate pci_rebar_size_supported() input

According to Dan Carpenter, smatch detects issue with size parameter given
to pci_rebar_size_supported():

drivers/pci/rebar.c:142 pci_rebar_size_supported()
error: undefined (user controlled) shift '(((1))) << size'

The problem is this call tree, which uses the 'size' from the user to shift
in BIT() without validating it:

__resource_resize_store # takes 'buf' from user sysfs write
kstrtoul(buf, 0, &size) # converts to unsigned long
pci_resize_resource # truncates to int
pci_rebar_size_supported # BIT(size) without validation

There could be similar problems also with pci_resize_resource() parameter
values coming from drivers.

Add 'size' validation to pci_rebar_size_supported().

There seems to be no SZ_128T prior to this so add one to be able to specify
the largest size supported by the kernel (PCIe r7.0 spec already defines
sizes even beyond 128TB but kernel does not yet support them).

The issue looks older than the introduction of pci_rebar_size_supported()
by bb1fabd0d94e ("PCI: Add pci_rebar_size_supported() helper").

It would be also nice to convert 'size' unsigned too everywhere, maybe even
u8 but that is left as further work.

Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/aSA1WiRG3RuhqZMY@stanley.mountain/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[bhelgaas: commit log, add report URL]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251124153740.2995-1-ilpo.jarvinen@linux.intel.com

authored by

Ilpo Järvinen and committed by
Bjorn Helgaas
48f01435 bf0a90fc

+4
+3
drivers/pci/rebar.c
··· 139 139 { 140 140 u64 sizes = pci_rebar_get_possible_sizes(pdev, bar); 141 141 142 + if (size < 0 || size > ilog2(SZ_128T) - ilog2(PCI_REBAR_MIN_SIZE)) 143 + return false; 144 + 142 145 return BIT(size) & sizes; 143 146 } 144 147 EXPORT_SYMBOL_GPL(pci_rebar_size_supported);
+1
include/linux/sizes.h
··· 67 67 #define SZ_16T _AC(0x100000000000, ULL) 68 68 #define SZ_32T _AC(0x200000000000, ULL) 69 69 #define SZ_64T _AC(0x400000000000, ULL) 70 + #define SZ_128T _AC(0x800000000000, ULL) 70 71 71 72 #endif /* __LINUX_SIZES_H__ */