6.18-stable patches

added patches:
	pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch

diff --git a/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch b/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch
new file mode 100644 (file)
index 0000000..217d75c
--- /dev/null
+++ b/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch
@@ -0,0 +1,63 @@
+From f34f1712229d71ce4286440fef12526fd4590b37 Mon Sep 17 00:00:00 2001
+From: Marco Nenciarini <mnencia@kcore.it>
+Date: Fri, 17 Apr 2026 15:24:37 +0200
+Subject: PCI/IOV: Skip VF Resizable BAR restore on read error
+
+From: Marco Nenciarini <mnencia@kcore.it>
+
+commit f34f1712229d71ce4286440fef12526fd4590b37 upstream.
+
+sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register
+to decide how many VF BARs to restore (nbars) and which VF BAR each
+iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],
+which has only PCI_SRIOV_NUM_BARS (6) entries.
+
+When a device does not respond, config reads typically return
+PCI_ERROR_RESPONSE (~0).  Both fields are 3 bits wide, so nbars and bar_idx
+both evaluate to 7. The barsz[] access then goes out of bounds.  UBSAN
+reports this as:
+
+  UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'
+
+Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding
+during a failed GC6 power state exit. The subsequent pci_restore_state()
+invoked sriov_restore_vf_rebar_state() while config reads returned
+0xffffffff, triggering the splat.
+
+Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.
+No further VF BARs are touched, which is safe because a config read that
+returns PCI_ERROR_RESPONSE indicates the device is unreachable and
+restoration is pointless. This mirrors the guard in
+pci_restore_rebar_state().
+
+Fixes: 5a8f77e24a30 ("PCI/IOV: Restore VF resizable BAR state after reset")
+Signed-off-by: Marco Nenciarini <mnencia@kcore.it>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/44a4ae53ec2825816b816c85cd378430d9a95cc6.1776429882.git.mnencia@kcore.it
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/iov.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -938,12 +938,18 @@ static void sriov_restore_vf_rebar_state
+               return;
+ 
+       pci_read_config_dword(dev, pos + PCI_VF_REBAR_CTRL, &ctrl);
++      if (PCI_POSSIBLE_ERROR(ctrl))
++              return;
++
+       nbars = FIELD_GET(PCI_VF_REBAR_CTRL_NBAR_MASK, ctrl);
+ 
+       for (i = 0; i < nbars; i++, pos += 8) {
+               int bar_idx, size;
+ 
+               pci_read_config_dword(dev, pos + PCI_VF_REBAR_CTRL, &ctrl);
++              if (PCI_POSSIBLE_ERROR(ctrl))
++                      return;
++
+               bar_idx = FIELD_GET(PCI_VF_REBAR_CTRL_BAR_IDX, ctrl);
+               size = pci_rebar_bytes_to_size(dev->sriov->barsz[bar_idx]);
+               ctrl &= ~PCI_VF_REBAR_CTRL_BAR_SIZE;

diff --git a/queue-6.18/series b/queue-6.18/series
index 85ab239c07c420a9140149485294c8508e939328..833b6e18277c48dc662552318e848b20880c1882 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -140,3 +140,4 @@ pci-host-common-request-bus-reassignment-when-not-probe-only.patch
 pci-imx6-fix-imx6sx_gpr12_pcie_test_powerdown-handling.patch
 pci-mediatek-fix-irq-domain-leak-when-port-fails-to-enable.patch
 pci-qcom-initialize-dwc-msi-lock-for-firmware-managed-ecam-hosts.patch
+pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch