]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
PCI: Validate pci_rebar_size_supported() input
authorIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
Mon, 24 Nov 2025 15:37:40 +0000 (17:37 +0200)
committerBjorn Helgaas <bhelgaas@google.com>
Mon, 24 Nov 2025 23:23:58 +0000 (17:23 -0600)
commit48f014356698a3525959a9eb343dc67b5a5c6842
tree6c17189a8fb257571050b6a235c93accfda69482
parentbf0a90fc907e47344f88e5b9b241082184dbac27
PCI: Validate pci_rebar_size_supported() input

According to Dan Carpenter, smatch detects issue with size parameter given
to pci_rebar_size_supported():

  drivers/pci/rebar.c:142 pci_rebar_size_supported()
  error: undefined (user controlled) shift '(((1))) << size'

The problem is this call tree, which uses the 'size' from the user to shift
in BIT() without validating it:

  __resource_resize_store         # takes 'buf' from user sysfs write
    kstrtoul(buf, 0, &size)       # converts to unsigned long
    pci_resize_resource           # truncates to int
      pci_rebar_size_supported    # BIT(size) without validation

There could be similar problems also with pci_resize_resource() parameter
values coming from drivers.

Add 'size' validation to pci_rebar_size_supported().

There seems to be no SZ_128T prior to this so add one to be able to specify
the largest size supported by the kernel (PCIe r7.0 spec already defines
sizes even beyond 128TB but kernel does not yet support them).

The issue looks older than the introduction of pci_rebar_size_supported()
by bb1fabd0d94e ("PCI: Add pci_rebar_size_supported() helper").

It would be also nice to convert 'size' unsigned too everywhere, maybe even
u8 but that is left as further work.

Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/aSA1WiRG3RuhqZMY@stanley.mountain/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[bhelgaas: commit log, add report URL]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251124153740.2995-1-ilpo.jarvinen@linux.intel.com
drivers/pci/rebar.c
include/linux/sizes.h