From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 13:28:11 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f295eeee0ffa9cf8bd153ce49c8a2ad507e3c4fb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch --- diff --git a/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch b/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch new file mode 100644 index 0000000000..217d75cedb --- /dev/null +++ b/queue-6.18/pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch @@ -0,0 +1,63 @@ +From f34f1712229d71ce4286440fef12526fd4590b37 Mon Sep 17 00:00:00 2001 +From: Marco Nenciarini +Date: Fri, 17 Apr 2026 15:24:37 +0200 +Subject: PCI/IOV: Skip VF Resizable BAR restore on read error + +From: Marco Nenciarini + +commit f34f1712229d71ce4286440fef12526fd4590b37 upstream. + +sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register +to decide how many VF BARs to restore (nbars) and which VF BAR each +iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], +which has only PCI_SRIOV_NUM_BARS (6) entries. + +When a device does not respond, config reads typically return +PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx +both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN +reports this as: + + UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]' + +Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding +during a failed GC6 power state exit. The subsequent pci_restore_state() +invoked sriov_restore_vf_rebar_state() while config reads returned +0xffffffff, triggering the splat. + +Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. +No further VF BARs are touched, which is safe because a config read that +returns PCI_ERROR_RESPONSE indicates the device is unreachable and +restoration is pointless. This mirrors the guard in +pci_restore_rebar_state(). + +Fixes: 5a8f77e24a30 ("PCI/IOV: Restore VF resizable BAR state after reset") +Signed-off-by: Marco Nenciarini +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/44a4ae53ec2825816b816c85cd378430d9a95cc6.1776429882.git.mnencia@kcore.it +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/iov.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -938,12 +938,18 @@ static void sriov_restore_vf_rebar_state + return; + + pci_read_config_dword(dev, pos + PCI_VF_REBAR_CTRL, &ctrl); ++ if (PCI_POSSIBLE_ERROR(ctrl)) ++ return; ++ + nbars = FIELD_GET(PCI_VF_REBAR_CTRL_NBAR_MASK, ctrl); + + for (i = 0; i < nbars; i++, pos += 8) { + int bar_idx, size; + + pci_read_config_dword(dev, pos + PCI_VF_REBAR_CTRL, &ctrl); ++ if (PCI_POSSIBLE_ERROR(ctrl)) ++ return; ++ + bar_idx = FIELD_GET(PCI_VF_REBAR_CTRL_BAR_IDX, ctrl); + size = pci_rebar_bytes_to_size(dev->sriov->barsz[bar_idx]); + ctrl &= ~PCI_VF_REBAR_CTRL_BAR_SIZE; diff --git a/queue-6.18/series b/queue-6.18/series index 85ab239c07..833b6e1827 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -140,3 +140,4 @@ pci-host-common-request-bus-reassignment-when-not-probe-only.patch pci-imx6-fix-imx6sx_gpr12_pcie_test_powerdown-handling.patch pci-mediatek-fix-irq-domain-leak-when-port-fails-to-enable.patch pci-qcom-initialize-dwc-msi-lock-for-firmware-managed-ecam-hosts.patch +pci-iov-skip-vf-resizable-bar-restore-on-read-error.patch