Skip to content

Commit 48f0143

Browse files
ij-intelbjorn-helgaas
authored andcommitted
PCI: Validate pci_rebar_size_supported() input
According to Dan Carpenter, smatch detects issue with size parameter given to pci_rebar_size_supported(): drivers/pci/rebar.c:142 pci_rebar_size_supported() error: undefined (user controlled) shift '(((1))) << size' The problem is this call tree, which uses the 'size' from the user to shift in BIT() without validating it: __resource_resize_store # takes 'buf' from user sysfs write kstrtoul(buf, 0, &size) # converts to unsigned long pci_resize_resource # truncates to int pci_rebar_size_supported # BIT(size) without validation There could be similar problems also with pci_resize_resource() parameter values coming from drivers. Add 'size' validation to pci_rebar_size_supported(). There seems to be no SZ_128T prior to this so add one to be able to specify the largest size supported by the kernel (PCIe r7.0 spec already defines sizes even beyond 128TB but kernel does not yet support them). The issue looks older than the introduction of pci_rebar_size_supported() by bb1fabd ("PCI: Add pci_rebar_size_supported() helper"). It would be also nice to convert 'size' unsigned too everywhere, maybe even u8 but that is left as further work. Fixes: 8bb705e ("PCI: Add pci_resize_resource() for resizing BARs") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/aSA1WiRG3RuhqZMY@stanley.mountain/ Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> [bhelgaas: commit log, add report URL] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251124153740.2995-1-ilpo.jarvinen@linux.intel.com
1 parent bf0a90f commit 48f0143

2 files changed

Lines changed: 4 additions & 0 deletions

File tree

drivers/pci/rebar.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,9 @@ bool pci_rebar_size_supported(struct pci_dev *pdev, int bar, int size)
139139
{
140140
u64 sizes = pci_rebar_get_possible_sizes(pdev, bar);
141141

142+
if (size < 0 || size > ilog2(SZ_128T) - ilog2(PCI_REBAR_MIN_SIZE))
143+
return false;
144+
142145
return BIT(size) & sizes;
143146
}
144147
EXPORT_SYMBOL_GPL(pci_rebar_size_supported);

include/linux/sizes.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,6 @@
6767
#define SZ_16T _AC(0x100000000000, ULL)
6868
#define SZ_32T _AC(0x200000000000, ULL)
6969
#define SZ_64T _AC(0x400000000000, ULL)
70+
#define SZ_128T _AC(0x800000000000, ULL)
7071

7172
#endif /* __LINUX_SIZES_H__ */

0 commit comments

Comments
 (0)